Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-66897: LXD can let attacker overwrite host files as root
CVE-2026-66897 · published 10 days ago
Summary
LXD’s template feature can be tricked into writing any file on the underlying server, even system files that require administrator rights. An attacker who can edit containers or launch a specially crafted image could replace critical files and run code with full control of the host. Apply the latest LXD updates and restrict container‑editing permissions to trusted users.
What to do
- Update canonical lxd to version 4.0.13 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | lxd | All versions |
| – | canonical | lxd | < 4.0.13 |
Original advisory text
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the h...
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.
References
- https://github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv Third Party Advisory
- https://github.com/canonical/lxd Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66897... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66897 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-66897 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-66897 Third Party Advisory
Severity
9.9
Critical
CVSS 3.1: 9.9 (MITRE)
CVSS 3.1: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-22Path Traversal
CWE-23Relative Path Traversal
Timeline
Published24 Aug 2026
Updated3 Sep 2026
First seen24 Aug 2026
Sources
CVE-2026-66897 · NVD
CVE-2026-66897 · MITRE
GHSA-q39m-8fx9-42fv · GHSA
CVE-2026-66897 · OSV
UBUNTU-CVE-2026-66897 · OSV
Monitor software like this
Free during beta