Incus EUVD-2026-108298

The attacker must be a client already authorized to create instances in at least one project (PR:L), and must use Incus's instance-backup import path. The concrete trigger is a crafted backup index.yaml in which a dependent custom volume name contains a ../ traversal chain; per the advisory this name reaches the volume-creation code without the name validation added for CVE-2026-81495/CVE-2026-81496, flows through filepath.Join into os.Mkdir, and escapes the storage pool directory. The attached-device gate is bypassed by splitting the traversal string across the device's pool and source fields because only the pool entry is resolved against a real storage pool. Limiting factors: exploitation requires instance-creation privilege (not anonymous), and affected versions are Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 only. The vendor's stated workaround is to only allow trusted clients to create instances; the complete fix is upgrading to the fixed branches (7.0.2 / 7.5.0).

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The signals are consistent and point the same direction: the vuln.today decision label is act_now, the CVSS 4.0 base score is 9.4 with full high impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), and the vendor (lxc/incus GHSA-hpjh-q53p-f27r) confirms arbitrary root-owned file write on the host leading to full host compromise plus cross-project volume creation. The attack vector is network (AV:N), low complexity (AC:L/AT:N), no user interaction (UI:N), and requires only low privileges (PR:L) - specifically a client already allowed to create instances. The notable limiter is that PR:L: this is not fully unauthenticated, so the realistic attacker is an authorized-but-untrusted tenant/project user rather than an anonymous internet attacker. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input - so there is no public exploit identified at time of analysis and no exploitation-probability signal to weigh. The absence of KEV/EPSS does not lower the severity of the primitive (reliable root file write via path traversal), but it does mean active-exploitation claims cannot be made. Net: prioritize patching for any multi-tenant or shared Incus deployment.

An attacker holding a low-privilege account permitted to create instances in a project crafts a malicious instance backup whose index.yaml lists a dependent custom volume with a ../ traversal chain in its name (split across the device pool and source fields to pass the attached-device gate). On import, the Incus daemon joins that name via filepath.Join and calls os.Mkdir, creating a root-owned directory with attacker-controlled contents at an arbitrary host path, resulting in full host compromise. No public exploit was identified at time of analysis, and exploitation requires an authenticated instance-creation privilege.