CVE-2026-97335

Improper link resolution in the recursive file pull feature of the LXD CLI client in versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10, and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

Missing authorization in imageDownload in Canonical LXD before versions 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

A vulnerability in Canonical LXD (versions 4.0 and later, fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) allows an authenticated client or a malicious migration source server to write attacker-controlled files to arbitrary paths on the host as root, leading to full host compromise. The attack uses a crafted rsync or btrfs send stream that plants a symlink in the transferred volume.

A path traversal vulnerability in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root. The attack uses a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

A path traversal vulnerability in the btrfs storage driver in Canonical LXD (versions 4.0.2 and later, fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) allows an authenticated client with permission to create instances to delete arbitrary files on the host as root. On hosts with btrfs root filesystem, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise.

Improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to image and backup endpoints. This affects LXD from 4.12 through 6.6 and was fixed in snap versions 5.0.6-e49d9f4, 5.21.4-1374f39, and 6.7-1f11451. The 4.0/stable channel is not affected as it contains version 4.0.10.

A Broken Access Control vulnerability in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.