takenaka hiroya@Joe_Biden_ja
コンテナ管理の Incus に、ホスト側へ任意のファイルを書かれる欠陥（CVSS 9.9）。コンテナから外へ出られる類の話なので、使っている人は修正版を確認してください。 https://cve.autoarticles.net/cve/CVE-2026-115377
0000014
557 followersView on X
CVE-2026-115377
LOWCVSS 9.4 · CRITICALImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-59
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE