CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv	Vendor Advisory Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:canonical:lxd::::::::
	cpe:2.3:a:canonical:lxd::::::::
	cpe:2.3:a:canonical:lxd::::::::
	cpe:2.3:a:canonical:lxd::::::::

History

No history.

Information

Published : 2026-08-24 10:16

Updated : 2026-09-11 15:28

NVD link : CVE-2026-66897

Mitre link : CVE-2026-66897

CVE.ORG link : CVE-2026-66897

JSON object : View

Products Affected

canonical

lxd

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-23

Relative Path Traversal

{"id": "CVE-2026-66897", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66897", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.13", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.9", "versionType": "semver"}, {"status": "affected", "version": "5.21.0", "lessThan": "5.21.7", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.10", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T10:16:39.767", "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv", "tags": ["Vendor Advisory", "Exploit"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution."}], "lastModified": "2026-09-11T15:28:53.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0F22A55-5146-4B91-9D3E-BC4509F506BE", "versionEndExcluding": "4.0.13"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DE002EB-DEFA-4284-A2C5-F68C71B121DF", "versionEndExcluding": "5.0.9", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84E5D160-5D14-4E78-AEDD-E9906420FB2E", "versionEndExcluding": "5.21.7", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "372FD242-9957-420D-BDDC-D4C81BB996D4", "versionEndIncluding": "6.9", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}