CVE-2026-16033
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this by providing a crafted image archive with malicious template directives containing path traversal sequences.
Risk Assessment
The attack can lead to disclosure of sensitive host files or writing files outside the intended directory, potentially enabling further privilege escalation or system integrity compromise.
Recommendation
Update LXD to a patched version and restrict image imports to trusted sources only.
Original NVD description (English source)
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.