Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 suffers an arbitrary file write vulnerability. By embedding a symlink into a migration stream, an attacker can cause the host to write data to an arbitrary path, such as the root filesystem. This flaw, identified as CWE-59, allows a malicious migration source to create files as the host's root user, resulting in complete system compromise.

The vulnerability impacts the Linux Containers Incus platform. Any instance of Incus versions prior to 6.0.7, 6.1.0 prior to 7.0.2, or 7.1.0 prior to 7.5.0 is affected. Deployments in these versions, regardless of configuration, are vulnerable if they accept migration streams unfiltered.

The CVSS score of 9.4 indicates critical severity. While an EPSS score is not available, the lack of listing in CISA KEV does not diminish the risk; the flaw can be triggered by an attacker who can send crafted rsync or btrfs receive streams. The attack vector is likely remote, with the attacker forming a malicious stream that contains a symlink pointing to a host path, such as rootfs. Once the stream is processed, the host writes files at the target location, granting the attacker root-level access to the system.