Incus, a system container and virtual machine manager, exposes an API that retrieves virtual machine screenshots. The API writes the image to a temporary file in a predictable location under /tmp before sending it back to the requester and deleting the file. When Incus versions prior to 6.23.0 are used, an attacker who can run commands locally can create a symlink in /tmp pointing to a file of the attacker’s choice. If the kernel’s protected_symlinks feature is disabled, Incus will follow the symlink, allowing the attacker to truncate the target file and alter its mode and ownership. This can lead to denial of service or local privilege escalation, as the attacker may gain unauthorized write access to arbitrary filesystem objects. The vulnerability involves path traversal weaknesses (CWE‑59 and CWE‑61).

The affected product is Incus from the Linux Containers project. Versions earlier than 6.23.0 are vulnerable to this exploit. The changelog for 6.23.0 and later mitigates the issue by using non‑predictable temporary file paths.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation is low under current conditions. The vulnerability is not listed in the CISA KEV catalog. The attack requires local system access and the ability to create symlinks in the /tmp directory. It is inferred that the most probable attack vector is an authenticated local user who has write permissions in the Incus environment or the /tmp filesystem.