CVE-2026-66897

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66897
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66897.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66897
Aliases
  • GHSA-q39m-8fx9-42fv
Downstream
Published
2026-08-24T09:08:04.188Z
Modified
2026-08-27T11:47:41.977985907Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Instance template path traversal allows arbitrary host file write as root
Details

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66897.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.10"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-22",
        "CWE-23"
    ],
    "cna_assigner": "canonical"
}
References

Affected packages

Git / github.com/canonical/lxd

Affected ranges

Type
GIT
Repo
https://github.com/canonical/lxd
Events
Introduced
03aab09f5b5cbdada00c6539877dcf5932fcde98
Fixed
03dbe5c82bc0852f30a52516a2ea813039b1ff1c
Introduced
1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1
Fixed
ace2cd39402c5cbad375143483d447bc6319af8d
Introduced
761d134ceabd306f57acfb0ca51f59b03751a5b0
Fixed
cfee9f274643195b4ce0d24cf01ccd13f18be85e
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.13"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.9"
        },
        {
            "introduced": "5.21.0"
        },
        {
            "fixed": "5.21.7"
        }
    ]
}

Affected versions

lxd-4.*
lxd-4.0.0
lxd-4.0.1
lxd-4.0.11
lxd-4.0.12
lxd-4.0.2
lxd-4.0.3
lxd-4.0.4
lxd-4.0.5
lxd-4.0.6
lxd-4.0.7
lxd-4.0.8
lxd-4.0.9
lxd-5.*
lxd-5.0.0
lxd-5.0.1
lxd-5.0.2
lxd-5.0.7
lxd-5.0.8
lxd-5.1
lxd-5.10
lxd-5.11
lxd-5.12
lxd-5.13
lxd-5.14
lxd-5.15
lxd-5.16
lxd-5.17
lxd-5.2
lxd-5.21.5
lxd-5.21.6
lxd-5.3
lxd-5.4
lxd-5.5
lxd-5.6
lxd-5.7
lxd-5.8
lxd-5.9
Other
show

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66897.json"