Symlink following vulnerability enabling root RCE in LXD (CVE-2026-63294)

LXD fails to validate backup.yaml when it exists as a symbolic link during image or backup archive unpacking. An unprivileged, project-confined user with image and instance creation rights can supply a crafted archive containing a symlinked backup.yaml, causing the root daemon to follow the symlink and write attacker-influenced content to arbitrary host files. This constitutes a multi-tenant privilege escalation resulting in arbitrary code execution as root on the host. Affected versions: - >= 4.0 We recommend updating to: 4.0.12, 5.0.8, 5.21.6, 6.10. CVSS 9.9 · our assessment: act_now Reference: https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m Details: https://vuln.today/cve/CVE-2026-63294