CVE-2026-85526

EUVD-2026-88257
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
canonicalCNA
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 45.18%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
canonicallxd
4.0.0 ≤
𝑥
< 4.0.14
CNA
canonicallxd
5.0.0 ≤
𝑥
< 5.0.10
CNA
canonicallxd
5.21.0 ≤
𝑥
< 5.21.8
CNA
canonicallxd
6.0 ≤
𝑥
< 6.10
CNA
Debian logo
Debian Releases
Debian Product
Codename
incus
forky
7.0.2-3
fixed
sid
7.0.2-3
fixed
trixie
6.0.4-2+deb13u10
fixed
trixie (security)
6.0.4-2+deb13u12
fixed
lxd
bookworm
vulnerable
bookworm (security)
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
incus
jammy
dne
noble
needs-triage
resolute
needs-triage
lxd
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/canonical/lxd-private/pull/103
https://github.com/canonical/lxd-private/pull/104
https://github.com/canonical/lxd-private/pull/105
https://github.com/canonical/lxd-private/pull/84
https://github.com/canonical/lxd-private/pull/87
https://github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rv