CVE-2026-81500: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-81500 is a path traversal vulnerability in the Incus CLI that allows a malicious or man-in-the-middle image server to overwrite arbitrary files on the client system when a user exports or copies an image into a directory target. It affects all versions of the github.com/lxc/incus/v7 Go module up to and including v7.3.0, with the fix introduced in v7.4.0. The vulnerability was published on August 27, 2026, and carries a CVSS v3.1 base score of 4.2 (Moderate) (GitHub Advisory). Feedly's preliminary assessment categorized it as HIGH severity, noting it is an unpatched vendor-indicated vulnerability affecting the Debian Linux Incus package at time of initial detection (Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). On the unified-image branch of the Incus CLI (client/incus_images.go:339), the server-controlled Content-Disposition: filename= header value is parsed via mime.ParseMediaType() and stored verbatim as resp.MetaName at line 356 with no call to filepath.Base() or any traversal sanitization. This tainted value is then passed directly to os.Rename(tmp, filepath.Join(target, resp.MetaName)) at cmd/incus/image.go:641. Two hash-guard bypasses exist: (a) the attacker sets the X-Incus-Type: oci response header to skip the hash check entirely, or (b) when the user supplies an alias, the fingerprint is itself server-controlled via GetImageAliasType().Target, allowing the attacker to set it to the SHA-256 of the malicious payload. The safe multipart branch is not affected because it uses multipart.Part.FileName(), which automatically basenames the value (GitHub Advisory).

A successful exploit allows an attacker controlling or intercepting an image server to overwrite arbitrary files on the client's filesystem with attacker-controlled content, running as the invoking user. A canonical example is overwriting ~/.bashrc with a malicious payload, resulting in remote code execution the next time the victim opens an interactive shell. The attack is limited to integrity and availability impacts (no direct confidentiality loss), and scope is confined to the client machine rather than the Incus daemon or host infrastructure (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of this report. The CVE status was initially "Reserved" with limited public details, and no CISA KEV listing or EPSS score is currently available. Exploitation requires the victim to actively run incus image export or incus image copy targeting a malicious or MITM'd server into a directory target — a workflow that is common when using public or untrusted Incus image servers. The attack complexity is rated High due to the requirement for either a MITM position or control of the image server the victim connects to (GitHub Advisory, Tenable).

1. Set up a malicious image server: Deploy an HTTP server that mimics an Incus image server and register it as a remote (e.g., evil) on the victim's Incus CLI, or position yourself as a MITM between the victim and a legitimate server.
2. Lure the victim: Convince the victim to run incus image export evil:someimg ~/Downloads/ or incus image copy evil:someimg local: with a directory target.
3. Force the unified-image branch: Respond to the /export request with Content-Type: application/octet-stream (not multipart/form-data) so the CLI takes the unified-image code path at client/incus_images.go:339.
4. Bypass the hash guard: Include the response header X-Incus-Type: oci to skip the hash verification check at client/incus_images.go:360.
5. Inject the traversal filename: Set Content-Disposition: attachment; filename="../../../../home/victim/.bashrc" in the HTTP response. The CLI stores this verbatim as resp.MetaName with no sanitization.
6. Deliver the malicious payload: The response body contains attacker-controlled content (e.g., a reverse shell command appended to .bashrc).
7. Achieve code execution: The CLI executes os.Rename(tmp, filepath.Join("~/Downloads", "../../../../home/victim/.bashrc")), overwriting the victim's .bashrc. On the victim's next interactive shell session, the injected commands execute as the victim user (GitHub Advisory).

• Network: Unexpected HTTP responses from an Incus image server containing Content-Disposition headers with ../ sequences in the filename parameter; responses with X-Incus-Type: oci combined with non-multipart Content-Type from untrusted or newly added remotes.
• File System: Unexpected modification timestamps on shell configuration files (~/.bashrc, ~/.bash_profile, ~/.profile), SSH config files (~/.ssh/authorized_keys, ~/.ssh/config), or cron files; files in the export target directory containing path traversal artifacts.
• Logs: Incus CLI activity logs showing incus image export or incus image copy commands targeting external or newly registered remotes; OS-level audit logs (auditd) recording rename() syscalls where the destination path escapes the intended export directory.
• Process: Unexpected processes spawned from the user's shell shortly after an incus image export operation, particularly reverse shells or outbound network connections (GitHub Advisory).

Upgrade the Incus CLI to v7.4.0 or later, which applies filepath.Base() to resp.MetaName (and resp.RootfsName) on the unified-image branch before the os.Rename call, mirroring the safe behavior of the multipart branch. No official workaround is available for users who cannot upgrade immediately; as a precaution, avoid running incus image export or incus image copy with a directory target against untrusted, public, or newly added remote image servers. OpenSUSE has also issued a security announcement addressing this issue (GitHub Advisory, OpenSUSE Advisory).

The vulnerability was disclosed by Incus project lead Stéphane Graber (stgraber) on August 27, 2026, crediting researcher Jace (@manus-use) as the reporter. Graber also published a blog post on August 31, 2026 announcing Incus 7.2.2, which appears related to the disclosure timeline. Linuxiac covered the Incus 7.4 release highlighting near-live container migration features, with the security fix bundled in that release. Debian issued a news announcement on September 12, 2026 referencing the updated package (stgraber blog, Linuxiac, Debian News).