What is the CVSS score of CVE-2026-16033?

CVE-2026-16033 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of LXD are affected by CVE-2026-16033?

Canonical LXD contains a critical vulnerability in virtual machine image processing that allows authenticated users to access and modify arbitrary files on the host system, directly breaking the…. A patch is available.

How to fix or mitigate CVE-2026-16033?

Within 24 hours: Restrict network access to LXD management APIs to trusted administrative networks only, and disable QEMU-based virtual machines if not operationally critical. Within 7 days: Deploy enhanced logging on LXD API calls and host filesystem access to detect exploitation attempts; review access controls to ensure only trusted administrators hold LXD management privileges. Within 30 days: Monitor Canonical's security advisories for patch availability; establish a rapid-deployment process to apply updates to Canonical LXD immediately upon release, and conduct a complete inventory of LXD deployments noting which are running QEMU virtual machines and which accounts have low-privilege LXD access.

LXD CVE-2026-16033

EUVD-2026-57547 HIGH

Path Traversal (CWE-22)

2026-08-12 canonical

Path Traversal Canonical Lxd

8.5

CVSS 3.1 · Vendor: canonical

Severity by source

Vendor (canonical) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

PR:L confirmed since LXD API access is required; S:C reflects host filesystem impact beyond the container/VM boundary; I:L for file creation without confirmed arbitrary modification.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (canonical).

CVSS VectorVendor: canonical

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 12, 2026 - 21:17 EUVD

Analysis Generated

Aug 12, 2026 - 20:49 vuln.today

CVE Published

Aug 12, 2026 - 20:11 cve.org

HIGH 8.5

DescriptionCVE.org

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.

AnalysisAI

Path traversal in Canonical LXD's image metadata template processing enables an authenticated low-privilege attacker to read arbitrary host files or create files in arbitrary host filesystem locations. The flaw resides in the virtual machine/QEMU driver execution path, where LXD fails to sanitize template file paths from escaping the designated instance templates directory. Exploitation crosses the container/VM boundary to the host (scope change, S:C), making this high-severity in environments where host isolation is a security assumption. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

LXD (cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*) is Canonical's system container and virtual machine manager, using LXC for containers and QEMU for VM workloads. This vulnerability manifests in the image metadata template processing pipeline - specifically the VM/QEMU driver code path - where image archives can include template files that LXD materializes on the host filesystem during instance initialization. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause: LXD fails to validate or canonicalize template paths against the designated instance templates root directory, allowing sequences such as '../../' to resolve outside the intended boundary. Because templates are processed with host-level filesystem access in the QEMU driver path, successful traversal operates on the host rather than the container filesystem. The wildcard CPE ('*') indicates all released LXD versions are affected, with no version ceiling confirmed from the available data.

RemediationAI

Consult the Canonical security advisory at https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh for the confirmed patched release - no exact fix version was provided in the available intelligence data, so a specific target upgrade version cannot be independently confirmed here. As a compensating control, restrict who can create LXD instances from untrusted or externally sourced image archives - specifically limit the LXD API 'image.create' and instance launch operations to fully trusted administrators only, removing low-privilege user access to image ingestion. If VM workloads are not required, temporarily disabling the QEMU driver and restricting instance types to containers may reduce the exploitable surface until a patch is applied. Note that this mitigation has an operational trade-off: it prevents VM-type instance creation entirely. Network-level restriction of the LXD API socket (typically Unix socket or HTTPS on port 8443) to authorized subnets or hosts reduces remote exploitation surface but does not eliminate the vulnerability for authorized low-privilege users.