Vulnerability · Published Aug 12, 2026 · Assigned by canonical
CVE-2026-63294Root RCE via image backup.yaml symlink
Critical 9.9
In plain English
A critical-severity security flaw in LXD from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | lxd | no fix listed | DEBIAN-CVE-2026-63294 |
| Debian:13 | lxd | no fix listed | DEBIAN-CVE-2026-63294 |
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m vdb-entry, vendor-advisory