A critical file path traversal vulnerability in LXC Incus permits authenticated users to perform arbitrary file operations on the host, leading to potential system-wide code execution.

This flaw involves external control of file names or paths (CWE-73), allowing a specially crafted image or instance backup to escape intended boundaries. An authenticated attacker can leverage this to read sensitive host files or overwrite critical system files to achieve arbitrary command execution.

The ability to manipulate host files effectively grants the attacker control over the host operating system. This could result in the exfiltration of sensitive configuration files, the injection of malicious binaries, or complete host takeover. The CVSS score of 9.9 reflects the severity of this unauthorized file system access.

Immediate Action: Update the LXC Incus software to version 7.2.0 or later to ensure proper validation of image and backup file paths.

Proactive Monitoring: Monitor host file system integrity and review logs for unusual file access patterns or suspicious backup import activities.

Compensating Controls: Implement strict container image source controls and ensure that backups are only accepted from trusted, internal sources to prevent the introduction of malicious artifacts.

Public Exploit Available: No

The severity of this issue necessitates an immediate patch deployment. Administrators should ensure all Incus instances are updated to version 7.2.0 to prevent potential host-level exploitation via malicious image or backup files.