EUVD-2026-57545Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Reachable via authenticated API (AV:N, PR:L) with trivial crafting (AC:L); traversal escapes the restore directory to the host, changing scope (S:C) with full host file read/overwrite (C/I/A:H).
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.
AnalysisAI
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write or read files outside the intended restore directory by embedding traversal sequences in the instance or storage-volume names stored in a crafted backup archive's metadata. Because LXD does not validate these names on import/restore, an attacker can corrupt or overwrite host files, potentially leading to full host compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to supply a backup archive to the target LXD and trigger a backup import or restore operation - that is the exact feature path in play. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mostly internally consistent and point to a genuine high priority rather than a merely high number: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a low-complexity, network-reachable attack that needs only some level of authenticated privilege (PR:L) yet crosses a security scope (S:C) to fully impact the host, which is what pushes the base score to 9.9. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A semi-trusted LXD user with permission to import backups crafts a backup archive whose instance or volume name in the metadata contains '../../' path traversal sequences pointing at a sensitive host location. When LXD imports or restores the archive, it writes archive contents to the traversed path, letting the attacker overwrite host configuration or binaries and pivot to host-level compromise. … |
| Remediation | Patch available per vendor advisory: upgrade LXD to the fixed release identified in Canonical's GitHub Security Advisory GHSA-m857-c7gc-c984 (https://github.com/canonical/lxd/security/advisories/GHSA-m857-c7gc-c984); an exact fixed version string was not included in the provided data, so confirm the patched build from that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all LXD installations and identify users with backup import/restore privileges; immediately restrict these privileges to only critical administrative accounts and log all backup operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attack
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attacker
A arbitrary file access vulnerability (CVSS 6.5) that allows an attacker with instance configuration permissions. Risk
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privile
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallo
Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authentica
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted proj
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today