CVE catalog

CVE-2026-115378

UBUNTU-CVE-2026-115378

[CVE catalog]

Severity
Unknown · CVSS 5.8CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianincus136.0.4-2vulnerable
Debianincus136.0.4-2+deb13u1vulnerable
Debianincus136.0.4-2+deb13u10vulnerable
Debianincus136.0.4-2+deb13u11vulnerable
Debianincus136.0.4-2+deb13u1~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u2vulnerable
Debianincus136.0.4-2+deb13u2~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u3vulnerable
Debianincus136.0.4-2+deb13u3~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u4vulnerable
Debianincus136.0.4-2+deb13u4~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u5vulnerable
Debianincus136.0.4-2+deb13u5~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u6vulnerable
Debianincus136.0.4-2+deb13u6~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u7vulnerable
Debianincus136.0.4-2+deb13u7~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u8vulnerable
Debianincus136.0.4-2+deb13u9vulnerable
Debianincus136.0.4-3vulnerable
Debianincus136.0.5-1vulnerable
Debianincus136.0.5-2vulnerable
Debianincus136.0.5-3vulnerable
Debianincus136.0.5-4vulnerable
Debianincus136.0.5-5vulnerable
Debianincus136.0.5-6vulnerable
Debianincus136.0.5-7vulnerable
Debianincus136.0.5-8vulnerable
Debianincus136.0.6-1vulnerable
Debianincus136.0.6-2vulnerable
Debianincus136.0.6-3vulnerable
Debianincus136.14.0-1~exp1vulnerable
Debianincus136.15.0-1~exp1vulnerable
Debianincus136.16.0-1~exp1vulnerable
Debianincus136.17.0-1~exp1vulnerable
Debianincus136.20.0-1~exp1vulnerable
Debianincus136.21.0-1~exp1vulnerable
Debianincus136.22.0-1~exp1vulnerable
Debianincus136.23.0-1~exp1vulnerable
Debianincus137.0.0-1vulnerable
Debianincus137.0.0-1~bpo13+1vulnerable
Debianincus137.0.0-2vulnerable
Debianincus137.0.0-2~bpo13+1vulnerable
Debianincus137.0.0-3vulnerable
Debianincus137.0.0-4vulnerable
Debianincus137.0.0-5vulnerable
Debianincus137.0.0-5~bpo13+1vulnerable
Debianincus137.0.1-1vulnerable
Debianincus137.0.1-1~bpo13+1vulnerable
Debianincus137.0.1-2vulnerable
Debianincus137.0.1-2~bpo13+1vulnerable
Debianincus137.0.1-3vulnerable
Debianincus137.0.1-3~bpo13+1vulnerable
Debianincus137.0.1-4vulnerable
Debianincus137.0.1-5vulnerable
Debianincus137.0.1-5~bpo13+1vulnerable
Debianincus137.0.1-6vulnerable
Debianincus137.0.2-1vulnerable
Debianincus137.0.2-2vulnerable
Debianincus137.1.0-1~exp1vulnerable
Debianincus137.2.0-1~exp1vulnerable
Debianincus137.2.0-1~exp2vulnerable
Debianincus137.2.0-1~exp3vulnerable
Debianincus137.3.0-1~exp1vulnerable
Debianincus137.4.0-1~exp1vulnerable
Debianincus137.5.1-1~exp1vulnerable
Debianincus137.5.1-1~exp2vulnerable
Debianincus146.0.4-2vulnerable
Debianincus146.0.4-3vulnerable
Debianincus146.0.5-1vulnerable
Debianincus146.0.5-2vulnerable
Debianincus146.0.5-3vulnerable
Debianincus146.0.5-4vulnerable
Debianincus146.0.5-5vulnerable
Debianincus146.0.5-6vulnerable
Debianincus146.0.5-7vulnerable
Debianincus146.0.5-8vulnerable
Debianincus146.0.6-1vulnerable
Debianincus146.0.6-2vulnerable
Debianincus146.0.6-3vulnerable
Debianincus146.14.0-1~exp1vulnerable
Debianincus146.15.0-1~exp1vulnerable
Debianincus146.16.0-1~exp1vulnerable
Debianincus146.17.0-1~exp1vulnerable
Debianincus146.20.0-1~exp1vulnerable
Debianincus146.21.0-1~exp1vulnerable
Debianincus146.22.0-1~exp1vulnerable
Debianincus146.23.0-1~exp1vulnerable
Debianincus147.0.0-1vulnerable
Debianincus147.0.0-1~bpo13+1vulnerable
Debianincus147.0.0-2vulnerable
Debianincus147.0.0-2~bpo13+1vulnerable
Debianincus147.0.0-3vulnerable
Debianincus147.0.0-4vulnerable
Debianincus147.0.0-5vulnerable
Debianincus147.0.0-5~bpo13+1vulnerable
Debianincus147.0.1-1vulnerable
Debianincus147.0.1-1~bpo13+1vulnerable
Debianincus147.0.1-2vulnerable
Debianincus147.0.1-2~bpo13+1vulnerable
Debianincus147.0.1-3vulnerable
Debianincus147.0.1-3~bpo13+1vulnerable
Debianincus147.0.1-4vulnerable
Debianincus147.0.1-5~bpo13+1vulnerable
Debianincus147.0.1-5fixed
Ubuntuincuspro6.0.4-2vulnerable
Ubuntuincuspro6.0.5-8vulnerable
Ubuntuincuspro6.0.5-8ubuntu0.26.04.1~esm1vulnerable
Ubuntuincus26.106.0.5-8vulnerable
Ubuntuincus26.107.0.1-5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianincusdeb147.0.1-5Not reportedDEBIAN-CVE-2026-115378Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [golang-github-lxc-incus-dev]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · all · trixie

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · all · trixie

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · all · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · all · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · all · trixie-security

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · all · trixie-security · Historical version

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · all · trixie-security

      Affected

      pypi · incus · debian · 13

  • [incus]Affected
    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected

      pypi · incus · debian · 13

  • [incus-agent]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected

      pypi · incus · debian · 13

  • [incus-base]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected

      pypi · incus · debian · 13

  • [incus-client]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected

      pypi · incus · debian · 13

  • [incus-extra]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected

      pypi · incus · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]