Canonical LXD EUVD-2026-88261

Requires (1) the attacker to already hold root inside a guest virtual machine managed by LXD, so they can replace the lxd-agent binary; (2) the host operator to invoke the recursive file pull feature of the LXD CLI client (e.g. recursive lxc file pull) against that malicious VM - this is the UI:R user-interaction requirement; and (3) affected client versions 4.0.2 through 6.9 on Linux. Limiting factors: the high complexity (AC:H) of forging inconsistent SFTP directory listings and Lstat results to win link-resolution handling, the need for operator action, and that impact is confined to file/directory writes on the host with the operator's privilege level (no confidentiality or availability impact). Hosts whose operators never run recursive pulls from untrusted VMs are effectively not exposed.

This is a genuine but constrained integrity issue, not a high-urgency threat. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N = 5.8 Medium) tells the real story: high attack complexity, low privileges required (root inside the guest is 'low' relative to the host trust boundary), and mandatory operator interaction. Exploitation is a reverse-trust / confused-deputy scenario - a compromised guest attacks the operator who pulls files out of it. There is no CVSS confidentiality or availability impact; the sole impact is integrity (arbitrary file write on the host). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is no public exploit identified at time of analysis. Signals are internally consistent: a vendor-self-reported (Canonical) medium-severity flaw with a coordinated GHSA advisory and patched releases, but nothing indicating widespread or automatable exploitation. Realistic priority is low-to-medium: patch during normal cycles, prioritize hosts where operators routinely run recursive file pulls against untrusted VMs. Note the input tag 'Information Disclosure' contradicts the vector (C:N, I:H) - this is a file-write/integrity flaw, not an info leak.

An attacker who has gained root inside an LXD-managed virtual machine replaces the lxd-agent with a modified version that returns inconsistent SFTP directory listings and Lstat results. When the host operator later runs a recursive file pull (e.g. lxc file pull -r) from that VM, the malicious agent tricks link resolution so files or entire directory trees are written to attacker-chosen absolute paths on the host, with the operator's privileges. No public exploit code is identified in the provided data, and the high attack complexity plus required operator action make this an opportunistic rather than reliable attack.