CVE-2026-63294

{"id": "CVE-2026-63294", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63294", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T12:38:32.604341Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.12", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.8", "versionType": "semver"}, {"status": "affected", "version": "5.21.0", "lessThan": "5.21.6", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.10", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}]}], "published": "2026-08-12T20:17:47.187", "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m", "tags": ["Third Party Advisory", "Exploit", "Mitigation"], "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m", "tags": ["Third Party Advisory", "Exploit", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges."}, {"lang": "es", "value": "Una vulnerabilidad de seguimiento de enlaces en LXD permite a un atacante lograr la ejecuci\u00f3n de comandos como root en el sistema anfitri\u00f3n. Durante la importaci\u00f3n o descompresi\u00f3n de archivos de imagen o de copia de seguridad manipulados, LXD no valida ni confina correctamente el archivo backup.yaml cuando este existe como un enlace simb\u00f3lico. Un atacante puede explotar esta falla proporcionando un archivo malicioso con un archivo backup.yaml con enlace simb\u00f3lico, lo que hace que LXD procese metadatos de configuraci\u00f3n no confinados y ejecute comandos arbitrarios con privilegios de root."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89DC62EE-69CD-4ACD-BB83-6A0635AC341C", "versionEndExcluding": "4.0.12", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59D070D6-84D2-400E-8260-EA52E5C60D37", "versionEndExcluding": "5.0.8", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "575036D1-2B55-4043-B94A-1584E3F2DA37", "versionEndExcluding": "5.21.6", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "374F5622-1D8F-4EF9-97E6-736C8220623B", "versionEndExcluding": "6.10", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}