Path traversal in LXD backup tarball restore enabling root file write / RCE (CVE-2026-66898)

LXD's backup import endpoint (POST /1.0/instances with Content-Type: application/octet-stream) reads the instance name from the tarball's backup/index.yaml verbatim, with no path validation, and uses it as an on-disk path segment before any name check runs. A project user holding the can_create_instances entitlement can supply a crafted archive whose name field contains path traversal sequences (e.g. ../../../../etc/cron.d/x), causing the daemon to create directories and write attacker-controlled file content outside the storage pool as root. Snapshot names within the same archive metadata represent a second identical vector; successful exploitation yields host remote code execution. Affected versions: - >= 4.0.0 We recommend updating to: 6.1, 5.21.2, 5.0.4, 4.0.12. CVSS 9.9 · our assessment: act_now Reference: https://github.com/canonical/lxd/security/advisories/GHSA-m857-c7gc-c984 Details: https://vuln.today/cve/CVE-2026-66898