CVE-2026-33945

CVE-2026-33945 is a critical path traversal vulnerability affecting Incus, a system container and virtual machine manager, in versions prior to 6.23.0. An authenticated attacker with low privileges can exploit a flaw in how systemd credentials are handled to write to arbitrary files as root outside the intended directory. Rated 9.6 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/I:H/A:H), this vulnerability allows for both privilege escalation and denial of service attacks, though it does not enable data exfiltration. While there is no known public exploit code or evidence of active exploitation, the vulnerability is actively discussed within the cybersecurity community and is on the Hot List. Organizations using Incus should upgrade to version 6.23.0 or later immediately.