CVE-2026-66897

Katalog CVE

CVSS 9.9 · Critical EPSS 0,72%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada canonical lxd. Skor CVSS 3.1 9.9 (Critical) menurut ubuntu.com.

Deskripsi (NVD)

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.

Rincian

Terbit di NVD

24 Agustus 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber ubuntu.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv advisory vendor · exploit