Incus, a system container and virtual machine manager, was found to allow an attacker to write files to arbitrary locations on the host when the exec-output directory is a symbolic link. The /instances/$name/exec endpoint records command output to files such as exec_UUID.stdout and exec_UUID.stderr. If exec-output points to a symlink, the .stdout file can be written with attacker‑specified content, enabling the injection of files that may execute arbitrary commands. This vulnerability is a classic example of CWE-73 relative path traversal/indirect file write, and also exhibits characteristics of CWE-61 absolute path traversal, allowing arbitrary file writes.

Affected vendor products include Incus from lxc, specifically any release earlier than version 7.2.0. The vulnerability applies to all instance images that rely on the exec-output mechanism, meaning any system running Incus 7.1.x or older is potentially impacted.

The CVSS score of 9.9 marks this flaw as critical, and the attack is likely to be carried out via the Incus REST API or command‑line interface that issues exec requests. Although the EPSS score of 0.00784 indicates a very low probability, the absence of an exploitation record in the KEV catalog does not reduce the potential danger, as the vulnerability remains unpatched in many environments. Once patched to 7.2.0 or later, the risk is removed.