CVE-2026-63293

Katalog CVE

CVSS 9.9 · Critical EPSS 0,59%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada canonical lxd. Skor CVSS 3.1 9.9 (Critical) menurut ubuntu.com.

Deskripsi (NVD)

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber ubuntu.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5 advisory vendor · exploit