CVE-2026-16033

Last refreshed2026-10-23

Status: UPDATED | Advisory ID: CVE-2026-16033

Key Details

CVE	CVE-2026-16033
CVSS Score / Version	8.5 (High) / CVSS v3.1
Updated	2026-10-23
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is low; availability impact is none.
Affected products	canonical lxd
Classified as	CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
canonical	lxd

Vendor

Product

Affected Versions

Patch Status

canonical

lxd

Subsystems	General OT
Sectors	Multiple

What to Know

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system. (NVD)

What to Do

Monitor canonical's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-16033
CVE	https://www.cve.org/CVERecord?id=CVE-2026-16033
Vendor advisory	https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-16033

CVE

https://www.cve.org/CVERecord?id=CVE-2026-16033

Vendor advisory

https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh