CVE-2026-85526

EUVD-2026-88257
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
canonicalCNA
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
canonicallxd
4.0.0 ≤
𝑥
< 4.0.14
CNA
canonicallxd
5.0.0 ≤
𝑥
< 5.0.10
CNA
canonicallxd
5.21.0 ≤
𝑥
< 5.21.8
CNA
canonicallxd
6.0 ≤
𝑥
< 6.10
CNA
Debian logo
Debian Releases
Debian Product
Codename
incus
forky
vulnerable
sid
7.0.1-5
fixed
trixie
vulnerable
trixie (security)
6.0.4-2+deb13u11
fixed
lxd
bookworm
vulnerable
bookworm (security)
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://github.com/canonical/lxd-private/pull/103
https://github.com/canonical/lxd-private/pull/104
https://github.com/canonical/lxd-private/pull/105
https://github.com/canonical/lxd-private/pull/84
https://github.com/canonical/lxd-private/pull/87
https://github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rv