CVE-2026-81496

Incus createFromBackup, which handles instance creation from an uploaded backup tarball, uses the instance name and snapshot names read from backup/index.yaml directly as on-disk path segments without validating them. A remote authenticated user who can POST a crafted backup to /1.0/instances can supply names containing path traversal sequences such as ../, so the root daemon creates directories and unpacks attacker-controlled content outside the storage pool. This allows arbitrary file write on the host and can lead to code execution.