Link following in LXD - CVE-2026-63294
Published: August 1, 2026
Vulnerability identifier: #VU140676
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-63294
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
LXD
LXD
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary code as root on the host.
The vulnerability exists due to improper link resolution in backup file handling in the image metadata unpacking and instance backup.yaml write logic when importing a crafted image and creating an instance from it. A remote user can supply an image containing a symlinked backup.yaml to overwrite a host file and execute arbitrary code as root on the host.
Exploitation requires image and instance creation rights in a project-confined environment, or an administrator to import or create an instance from an untrusted image.
How to mitigate CVE-2026-63294
Install security update from vendor's website.