CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh	Vendor Advisory Exploit
https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh	Vendor Advisory Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:canonical:lxd::::::::
	cpe:2.3:a:canonical:lxd::::::::

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de salto de ruta en LXD permite a un atacante lograr la lectura arbitraria de archivos del host o la creación de archivos sin restricciones. Al procesar plantillas de metadatos de imagen, LXD no logra sanear o restringir adecuadamente las rutas de archivo de plantilla para que no escapen del directorio de plantillas de instancia (afectyo específicamente las rutas de ejecución del controlador de máquina virtual / QEMU). Un atacante puede explotar esta falla al proporcionar un archivo de imagen manipulado con directivas de plantilla maliciosas que contienen secuencias de salto de ruta, lo que hace que LXD acceda o escriba archivos fuera del directorio de plantillas previsto en el sistema host.

Information

Published : 2026-08-12 21:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-16033

Mitre link : CVE-2026-16033

CVE.ORG link : CVE-2026-16033

JSON object : View

Products Affected

canonical

lxd

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-16033", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16033", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T12:45:51.004847Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.12", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.8", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}]}], "published": "2026-08-12T21:17:35.880", "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh", "tags": ["Vendor Advisory", "Exploit"], "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh", "tags": ["Vendor Advisory", "Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en LXD permite a un atacante lograr la lectura arbitraria de archivos del host o la creaci\u00f3n de archivos sin restricciones. Al procesar plantillas de metadatos de imagen, LXD no logra sanear o restringir adecuadamente las rutas de archivo de plantilla para que no escapen del directorio de plantillas de instancia (afectyo espec\u00edficamente las rutas de ejecuci\u00f3n del controlador de m\u00e1quina virtual / QEMU). Un atacante puede explotar esta falla al proporcionar un archivo de imagen manipulado con directivas de plantilla maliciosas que contienen secuencias de salto de ruta, lo que hace que LXD acceda o escriba archivos fuera del directorio de plantillas previsto en el sistema host."}], "lastModified": "2026-10-23T19:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89DC62EE-69CD-4ACD-BB83-6A0635AC341C", "versionEndExcluding": "4.0.12", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C358ED3B-0384-494A-A494-18A37947E057", "versionEndExcluding": "5.0.7", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}