An authenticated user can upload arbitrarily large amounts of data to the Incus server before version 7.0.0, causing the server to consume excessive disk space and potentially bring the host system down. The vulnerability is an instance of resource exhaustion (CWE-770) and directly impacts the Confidentiality, Integrity, and Availability of the host environment by risking service interruption.

The affected product is the Incus container and virtual machine manager (lxc:incus) running any version earlier than 7.0.0. Users who upload large datasets without using the default IncusOS storage volumes for images or backups are at risk.

The CVSS score of 4.3 indicates moderate severity, and the absence of an EPSS score means that the exact exploitation probability is not quantified. This issue is not listed in CISA's KEV catalog, suggesting that it has not yet been widely exploited. The anticipated attack vector is a legitimate authenticated user leveraging the upload functionality to drain host disk resources; thus preventing or limiting such uploads mitigates the risk.