Moyenne
6.9
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write...
CVE-2026-115378
Première détection SecPulse
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| lxc | incus |
< 6.0.7 ≥ 6.1.0, < 7.0.2 ≥ 7.1.0, < 7.5.0 |
6.0.7 7.0.2 7.5.0 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
Références
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com