CVE catalog

CVE-2026-66897

Severity: Critical · CVSS 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Aug 24, 2026, 10:16:00 AM UTC
Updated: Aug 24, 2026, 10:16:39 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.72% · Oct 25, 2026

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	lxd	trixie	`5.0.2+git20231211.1364ae4-9+deb13u7`	vulnerable
Debian	lxd	trixie-security	`5.0.2+git20231211.1364ae4-9+deb13u7`	vulnerable
Debian	lxd	bookworm	`5.0.2-5+deb12u6`	vulnerable
Debian	lxd	bookworm-security	`5.0.2-5+deb12u6`	vulnerable
Cpe	lxd	Not reported	Not reported	unknown
Ubuntu	lxd	pro	`2.18-0ubuntu6`	vulnerable
Ubuntu	lxd	pro	`2.19-0ubuntu1`	vulnerable
Ubuntu	lxd	pro	`2.20-0ubuntu3`	vulnerable
Ubuntu	lxd	pro	`2.20-0ubuntu4`	vulnerable
Ubuntu	lxd	pro	`2.21-0ubuntu1`	vulnerable
Ubuntu	lxd	pro	`2.21-0ubuntu2`	vulnerable
Ubuntu	lxd	pro	`2.21-0ubuntu3`	vulnerable
Ubuntu	lxd	pro	`2.21-0ubuntu4`	vulnerable
Ubuntu	lxd	pro	`3.0.0~beta2-0ubuntu3`	vulnerable
Ubuntu	lxd	pro	`3.0.0~beta3-0ubuntu3`	vulnerable
Ubuntu	lxd	pro	`3.0.0~beta5-0ubuntu2`	vulnerable
Ubuntu	lxd	pro	`3.0.0~beta7-0ubuntu1`	vulnerable
Ubuntu	lxd	pro	`3.0.0-0ubuntu1`	vulnerable
Ubuntu	lxd	pro	`3.0.0-0ubuntu2`	vulnerable
Ubuntu	lxd	pro	`3.0.0-0ubuntu3`	vulnerable
Ubuntu	lxd	pro	`3.0.0-0ubuntu4`	vulnerable
Ubuntu	lxd	pro	`3.0.1-0ubuntu1~18.04.1`	vulnerable
Ubuntu	lxd	pro	`3.0.2-0ubuntu1~18.04.1`	vulnerable
Ubuntu	lxd	pro	`3.0.3-0ubuntu1~18.04.1`	vulnerable
Ubuntu	lxd	pro	`3.0.3-0ubuntu1~18.04.2`	vulnerable
Ubuntu	lxd	pro	`3.0.3-0ubuntu1~18.04.2+esm1`	vulnerable
Ubuntu	lxd	pro	`3.0.3-0ubuntu1~18.04.2+esm2`	vulnerable
Ubuntu	lxd	pro	`3.0.3-0ubuntu1~18.04.2+esm3`	vulnerable
Ubuntu	lxd	20.04	`1:0.7`	vulnerable
Ubuntu	lxd	20.04	`1:0.8`	vulnerable
Ubuntu	lxd	20.04	`1:0.9`	vulnerable
Ubuntu	lxd	20.04	`1:0.10`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	lxd	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	lxd	source	bookworm	`(unfixed)`	end-of-life	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lxd]Affected
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-agent]Affected
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-client]Affected
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-migrate]Affected
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
[lxd-tools]Affected
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · lxd · debian · bookworm; nvd · lxd · debian · 12

[Debian 13 (Trixie)]

[golang-github-canonical-lxd-dev]Affected
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · all · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd]Affected
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-agent]Affected
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-client]Affected
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-migrate]Affected
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13
[lxd-tools]Affected
Source package: [lxd]
Details (4)
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · amd64 · trixie-security
  Affected
  nvd · lxd · debian · 13
- 5.0.2+git20231211.1364ae4-9+deb13u7 · arm64 · trixie-security
  Affected
  nvd · lxd · debian · 13

Observed: Oct 27, 2026, 7:01:51 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]