LXD CVE-2026-63294

Requires that LXD import or unpack an attacker-supplied image or backup archive that contains a backup.yaml entry crafted as a symbolic link - that malicious-symlink-in-archive is the concrete trigger. Exploitation therefore depends on the attacker being able to initiate an import/restore (typically authenticated low-privilege LXD access, PR:L) or on an operator being induced to import the crafted archive; it is not a passive network exploit against an idle daemon. Limiting factors: deployments that never import externally-sourced images/backups, or that restrict import to fully trusted administrators, are not realistically reachable, and the flaw is specific to LXD's archive-unpack path rather than default idle operation.

The signals are largely consistent and point to a genuine high priority: CVSS 9.9 with AV:N/AC:L/PR:L/UI:N and a scope change (S:C) reflecting container-to-host escape, reported by Canonical's own security team through an official GitHub advisory, which lends high credibility to the technical claim. The main caveat is that AV:N is optimistic for the described workflow - exploitation hinges on getting a crafted archive imported, which in practice requires at least authenticated/low-privileged LXD API access (PR:L) or convincing an operator to import the archive, so realistic reachability is narrower than a pure remote-unauthenticated bug. EPSS is not provided and there is no KEV listing or known POC, so exploitation probability cannot be quantified from the data, and the 'Information Disclosure' tag appears mislabeled given the description clearly states root command execution. Given the trivial exploit primitive (a symlink in an archive) and root-level impact, any organization running LXD as a multi-tenant or shared host - even a mid-sized municipal IT team in legnica should treat this as urgent - ought to prioritize patching over waiting for exploit code to surface.

An attacker with low-privileged access to an LXD deployment (or one who can get an operator to restore a supplied backup) crafts a backup archive in which backup.yaml is a symbolic link pointing outside the extraction directory. When LXD imports/unpacks the archive, it follows the symlink and processes attacker-controlled configuration metadata as root, resulting in arbitrary command execution on the host. No public POC is currently identified, but the primitive (a symlink inside a tar archive) is simple to construct.