CVE-2026-115377
Description
A flaw was found in Incus. An attacker controlling a malicious migration source can exploit an arbitrary file write vulnerability by embedding symbolic links (symlinks) into transferred storage volumes during migration streams. By directing these links to the underlying host filesystem, the attacker can overwrite critical system files with root privileges, potentially resulting in full host compromise.
Statement
This vulnerability is rated as Critical because successful exploitation allows an untrusted migration source to escape storage containment and modify arbitrary host files with administrative privileges, leading to full system compromise. Incus is not packaged or supported within Red Hat Enterprise Linux or any other Red Hat enterprise products, so default deployments are unaffected.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
