Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by canonical

CVE-2026-85526Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD

Critical 9.9

In plain English

A critical-severity path traversal in LXD from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13incus6.0.4-2+deb13u1DEBIAN-CVE-2026-85526
Debian:14incus7.0.1-5DEBIAN-CVE-2026-85526
Debian:12lxdno fix listedDEBIAN-CVE-2026-85526
Debian:13lxdno fix listedDEBIAN-CVE-2026-85526
Ubuntu:26.10incusno fix listedUBUNTU-CVE-2026-85526

Affected products (as reported)

VendorProductVersions
Canonical LXD 4.0.0 – before 4.0.145.0.0 – before 5.0.105.21.0 – before 5.21.86.0 – before 6.10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References