EUVD-2026-108301

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entrie...

CVE-2026-115378

The Incus container management platform contains an arbitrary file write vulnerability in the sftpRecursivePullFile function. Affected versions include those before 6.0.7 , 6.1.0 before 7.0.2 , and 7.1.0 before 7.5.0 . A malicious incus-agent can escape the target directory during an incus file p...