Incus, a system container and virtual machine manager, allows retrieval of VM screenshots via an API that writes to a temporary file in /tmp. Versions before 6.23.0 generate predictable paths for this temporary file, permitting an attacker with local access to create a pre‑existing symbolic link at that path. When protected_symlinks is disabled, Incus truncates the target file and alters its mode and permissions, effectively overwriting arbitrary files. This can lead to denial of service or local privilege escalation. The vulnerability is a classic path traversal and insecure temporary file issue, classified as CWE‑61.

The affected product is Incus from the LXC project. All releases prior to 6.23.0 are vulnerable. The problem arises on Linux systems where the Incus API writes screenshots to predictable /tmp paths and the kernel’s protected_symlinks feature is disabled.

The CVSS score is 4.7, indicating low to moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Attackers require local system access and the ability to create symlinks in /tmp. On systems with the default (enabled) protected_symlinks setting, the risk is mitigated, but on rare distributions where the feature is purposely disabled, local users can leverage the path to erase and overwrite arbitrary files, potentially gaining elevated privileges or causing a denial of service.