CVE-2026-87798

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/canonical/lxd/security/advisories/GHSA-mr8v-hx34-hfvf

Configurations

No configuration.

History

28 Sep 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 14:17

Updated : 2026-09-28 17:17

NVD link : CVE-2026-87798

Mitre link : CVE-2026-87798

CVE.ORG link : CVE-2026-87798

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-87798", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87798", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T14:04:47.395647Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "4.0.2", "lessThan": "4.0.14", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.10", "versionType": "semver"}, {"status": "affected", "version": "5.21.0", "lessThan": "5.21.8", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.9", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}]}], "published": "2026-09-28T14:17:21.290", "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-mr8v-hx34-hfvf", "source": "security@ubuntu.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results."}], "lastModified": "2026-09-28T17:17:51.673", "sourceIdentifier": "security@ubuntu.com"}