CVE-2026-115378
Description
A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating between symbolic links and regular files, the attacker can cause the transfer process to escape the intended destination directory. This allows the attacker to overwrite sensitive files on the operator's host, potentially compromising the host system.
Statement
This vulnerability is rated as Moderate severity because exploitation requires an attacker to already possess elevated administrative privileges within a guest environment and relies on host operator interaction to initiate a recursive transfer. Although successful exploitation could allow writing arbitrary files to the host filesystem, it cannot be triggered autonomously over the network. Incus is not distributed or supported in Red Hat Enterprise Linux, limiting exposure across standard Red Hat enterprise deployments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
