{"action":"Upgrade incus to 6.0.4-2+deb13u1 or later.","affected":[{"fixed":"6.0.4-2+deb13u1","introduced":"0"}],"component":"incus","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["6.0.4-2+deb13u1"],"id":"tcs_01M5NVZEWF163YAJGDJHMEH5ZY","modified_at":"2026-10-04T00:00:13.575750216Z","published_at":"2026-09-28T14:17:20.130Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-85185","https://security-tracker.debian.org/tracker/CVE-2026-85185"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-85185","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-85185"}],"summary":"Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instan"}