Paper/Archive/CVE-2026-66898

CVE-2026-66898

Canonical LXD — Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 48.3.483 × 209.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.

Affected

ProductAffectedFixed inSource

LXD4.0.0 – < 4.0.124.0.12CNA

LXD5.0.0 – < 5.0.45.0.4CNA

LXD5.21.0 – < 5.21.25.21.2CNA

LXD6.0 – < 6.16.1CNA

Scores by source

canonical (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/canonical/lxd/security/advisories/GHSA-m857-c7gc-c984