The vulnerability allows an attacker to write to arbitrary files within the host filesystem by crafting a specially named credential configuration key. Because the key can include directory traversal sequences, Incus writes the specified data outside the intended credentials directory, allowing the writing of any file as the root user. This results in full privilege escalation and can also be used to cause denial of service by corrupting critical host files. The weakness corresponds to CWE‑22, an absolute path traversal flaw.

The flaw affects instances of the Incus container and VM manager produced by the lxc:incus vendor. Any installation of Incus prior to version 6.23.0 is vulnerable. Versions 6.23.0 and newer contain a fix that sanitizes credential keys.

The CVSS score is 10, indicating the highest possible severity. Although an official EPSS score is not yet available, the absence of any mitigation in the strategy suggests that exploitation is straightforward for a local attacker who can influence container configuration. The vulnerability is not listed in the CISA KEV catalog, but its potential for root access and the lack of traffic shaping make it a high‑priority target. The attack vector is inferred to be local or network‑bound to the Incus management interface, depending on the host configuration.