CVE-2026-85526

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85526
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85526.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85526
Aliases
  • GHSA-h85r-gjgx-g2rv
Downstream
Published
2026-09-28T13:21:40Z
Modified
2026-09-29T03:47:13Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
Details

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Database specific 
{
    "cna_assigner":  "canonical",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85526.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "6.0"
                },
                {
                    "fixed":  "6.10"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/canonical/lxd

Affected ranges

Type
GIT
Repo
https://github.com/canonical/lxd
Events
Introduced
03aab09f5b5cbdada00c6539877dcf5932fcde98
Fixed
b6e6806eef1ffb9be88d80af840f82d762ba1e38
Introduced
1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1
Fixed
6dbdad8c58bbabc680340c61d238255cccece068
Introduced
761d134ceabd306f57acfb0ca51f59b03751a5b0
Fixed
a60b9e26b2e4b8a3353e29d8be45eb623ad16ead
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.0.14"
        },
        {
            "introduced":  "5.0.0"
        },
        {
            "fixed":  "5.0.10"
        },
        {
            "introduced":  "5.21.0"
        },
        {
            "fixed":  "5.21.8"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

lxd-4.*
lxd-4.0.0
lxd-4.0.1
lxd-4.0.11
lxd-4.0.12
lxd-4.0.13
lxd-4.0.2
lxd-4.0.3
lxd-4.0.4
lxd-4.0.5
lxd-4.0.6
lxd-4.0.7
lxd-4.0.8
lxd-4.0.9
lxd-5.*
lxd-5.0.0
lxd-5.0.1
lxd-5.0.2
lxd-5.0.7
lxd-5.0.8
lxd-5.0.9
lxd-5.1
lxd-5.10
lxd-5.11
lxd-5.12
lxd-5.13
lxd-5.14
lxd-5.15
lxd-5.16
lxd-5.17
lxd-5.2
lxd-5.21.5
lxd-5.21.6
lxd-5.21.7
lxd-5.3
lxd-5.4
lxd-5.5
lxd-5.6
lxd-5.7
lxd-5.8
lxd-5.9
Other
show

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85526.json"