CVE-2026-115375

{
  "etk_id": "ETK-2026-2512",
  "cve_id": "CVE-2026-115375",
  "display_id": "CVE-2026-115375",
  "ghsa_id": "GHSA-f963-f2v2-v6x5",
  "euvd_id": "EUVD-2026-108298",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Incus backup import",
  "summary": "Affected Incus releases mishandle custom volume names when importing instance backups. A client with permission to create instances can cause files or directories to be written on the host, potentially resulting in host takeover.",
  "mitigation": "Upgrade the 7.0 release line to 7.0.2 or later, or the 7.1 release line to 7.5.0 or later. Until upgraded, restrict instance creation and backup import permissions to trusted administrators.",
  "vendor": "lxc",
  "product": "incus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.0.0, < 7.0.2",
        ">= 7.1.0, < 7.5.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.0.2",
        "7.5.0"
      ],
      "package_name": "incus",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 55.40758045,
  "t0_at": "2026-10-22T19:13:44.760000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T19:13:44.760000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T19:13:44.760000+00:00",
      "url": "https://github.com/advisories/GHSA-f963-f2v2-v6x5"
    }
  }
}