Incus versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contain a path traversal flaw that lets authorized clients create instances with a crafted backup pointing to dependent custom volume names containing '../' sequences in index.yaml files. This allows the attacker to write files in arbitrary locations on the host with root ownership, enabling arbitrary code execution and full host compromise. The weakness corresponds to CWE-22, a classic path traversal condition.

Linux Containers Incus 7.0.0 prior to 7.0.2 and Incus 7.1.0 prior to 7.5.0 are vulnerable. Any systems running these releases without the update are exposed.

The CVSS score of 9.4 indicates critical severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by uploading a malicious instance backup that includes '../' fragments in dependent volume names; the vulnerability is exploitable by anyone who has the capability to create or import backup files in Incus. Because the flaw permits writing root-owned files, a successful exploit results in full host compromise.