Canonical LXD CVE-2026-86334

Exploitation requires the victim to actively run an LXD CLI image export or copy operation (lxc image export/lxc image copy) targeting a LOCAL DIRECTORY, and the remote image server they pull from must be attacker-controlled OR the attacker must hold a machine-in-the-middle position on that connection to inject a crafted Content-Disposition filename parameter (absolute path or ../ traversal) during unified or split image transfer. Affected only in LXD 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10. Limiting factors: required user interaction (UI:R), high attack complexity from needing a hostile/interceptable image source (AC:H), and no impact on clients that only pull from trusted first-party image servers - this is a reverse-trust flaw, not a server-side or default-config remote exploit.

This is a low-to-moderate real-world risk that is correctly rated by its modest CVSS 3.1 base score of 4.2, and the score reflects genuine exploitation friction rather than under-scoring. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) captures a reverse-trust flaw: the 'attacker' is not a client-side threat actor but a malicious or man-in-the-middle IMAGE SERVER that the LXD client connects to. AC:H reflects that the attacker must control (or intercept, via TLS/transport interception) the remote image server, and UI:R reflects that the victim must voluntarily initiate an image export or copy into a local directory. There is no EPSS, no CISA KEV listing, and no packaged public exploit - so exploitation status is 'no public exploit identified at time of analysis' - though the vendor's own fix PR#18977 ships regression tests demonstrating the exact traversal vectors (/etc/cron.d/evil.tar.gz, ../../evil.tar.gz), which effectively documents the technique. I disagree modestly with the vendor's I:L/A:L impact rating: the described primitive is arbitrary local file OVERWRITE leading to code execution on the client (e.g. dropping a crontab or shell profile), which is closer to I:H and could cascade to full client compromise; this is a point to verify against the vendor advisory. Net: not a fleet-wide fire drill, but relevant to anyone whose CI/automation pulls LXD images from untrusted or network-adjacent-interceptable servers.

An attacker stands up (or MitM-intercepts) an LXD image server and waits for a victim to run lxc image export or lxc image copy from it into a local directory. The malicious server returns an image with a Content-Disposition header whose filename is a traversal/absolute path (e.g. /etc/cron.d/evil.tar.gz or ../../evil), causing the client to write attacker-controlled content outside the intended target and achieve code execution on the client host. No packaged exploit is published, but the vendor's patch includes tests that concretely demonstrate the crafted-header vectors.