Incus, a system container and virtual machine manager, contains a configuration flaw that allows an attacker to supply a specially crafted credential key such as systemd.credential.XYZ to write outside the allowed credentials directory. By steering the key name to contain path-traversal fragments, the software opens the opportunity to write arbitrary files as root, leading to privilege escalation or denial of service. The vulnerability is a directory traversal/file write problem classified as CWE-22.

Affected systems are deployments using the Linux Containers Incus container manager from the LXC project. Versions older than 6.23.0 are impacted; this includes all releases where the systemd credential syntax has been implemented without proper sanitization, such as 6.22.x and earlier. Any container or VM running under those versions is vulnerable if credentials are exposed.

This issue has a CVSS score of 10 and an EPSS score of less than 1%, indicating a high severity but a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves the attacker having the ability to set or modify configuration for a container or virtual machine, for example via the Incus API or control interface, in order to inject a malicious credential key that traverses directories and writes to arbitrary files as root. No complete remote exploit path is disclosed, but the flaw provides local root-escapable write capabilities.