SB20260925261 - Multiple vulnerabilities in LXD

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260925261

SB20260925261 - Multiple vulnerabilities in LXD

Published: September 25, 2026

Security Bulletin ID SB20260925261
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 43% Low 57%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Link following (CVE-ID: CVE-2026-87798)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write attacker-controlled files to arbitrary paths on the machine running the CLI with the operator's privileges.

The vulnerability exists due to improper handling of inconsistent directory entries in sftpRecursivePullFile when recursively pulling files from a compromised virtual machine. A remote user can return the same entry name with inconsistent file types to write through a previously created symbolic link to arbitrary paths.

User interaction is required because an operator must run a recursive file pull from the compromised virtual machine. Containers are not affected.


2) Link following (CVE-ID: CVE-2026-87799)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write attacker-controlled files to arbitrary paths on the target host.

The vulnerability exists due to improper handling of symbolic links in the migration stream receiver when receiving an instance or custom storage volume through migration. A remote user can supply a crafted migration stream containing a symbolic link that causes later entries to be written through it to write attacker-controlled files to arbitrary paths on the target host.

For virtual machines, a crafted stream can replace the root.img block file with a symbolic link before the block stream is written through it.


3) Missing Authorization (CVE-ID: CVE-2026-97335)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the custom storage volume copy handling of the POST /1.0/storage-pools/{pool}/volumes/custom endpoint when processing a crafted request that omits source.type. A remote user can submit a request with a caller-controlled source project to disclose sensitive information.

Exploitation requires permission to create custom storage volumes in a project.


4) Relative Path Traversal (CVE-ID: CVE-2026-85185)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete arbitrary host files and place attacker-controlled content outside the storage pool.

The vulnerability exists due to relative path traversal in the btrfs storage driver when processing attacker-supplied subvolume paths in optimized backup headers or migration metadata. A remote user can supply a subvolume path containing directory traversal sequences to delete arbitrary host files or place attacker-controlled content outside the storage pool.

Content placement outside the pool is limited to deployments where the btrfs storage pool is on the host root filesystem.


5) Path traversal (CVE-ID: CVE-2026-85526)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to manipulate arbitrary files and directories on the host.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in the btrfs optimized-backup subvolume path handling when restoring an uploaded backup archive to a btrfs storage pool. A remote user can supply a crafted subvolumes[].path value that escapes the volume mount point to manipulate host filesystem paths as root.

Exploitation requires permission to create instances or storage volumes and a btrfs storage pool.


6) Missing Authorization (CVE-ID: CVE-2026-86335)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose private image properties and files from another project.

The vulnerability exists due to missing authorization in the imageDownload image reuse logic when processing image import requests that reference a private image fingerprint. A remote user can submit an image import request referencing a known private image fingerprint to disclose private image properties and files from another project.

Exploitation requires image creation permissions in the requesting project.


7) Path traversal (CVE-ID: CVE-2026-86334)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite arbitrary files on the client.

The vulnerability exists due to path traversal in the unified image export and copy handling of the CLI when processing a server-controlled Content-Disposition filename for an image exported to a directory target. A remote attacker can provide a crafted filename containing path traversal sequences to overwrite files outside the export directory.

User interaction is required because the victim must export or copy an image from the malicious server to a directory target.


Remediation

Install update from vendor's website.

References