Aller au contenu
en Se connecter
6.9 Moyenne

CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in…

Description

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

Produits et versions touchés

Produit Versions touchées Corrigé en
incus 7.5 premières → < 7.5.0 7.5.0
incus 7.1 7.1.0 → < 7.5.0 7.5.0
incus 7.0 premières → < 7.0.2 7.0.2
incus 6.1 6.1.0 → < 7.0.2 7.0.2
incus 6.0 premières → < 6.0.7 6.0.7

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de incus

Les 47 CVE de incus →
CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that… 9.4 Critique CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows… 8.3 Élevée CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 9.4 Critique CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET… 7.0 Élevée
Suivre cette CVE