← All Advisories
Reported from OT-Advisories.com as of

CVE-2026-63293

Last refreshed2026-10-23

Status: UPDATED  |  Advisory ID: CVE-2026-63293

Key Details

CVECVE-2026-63293
CVSS Score / Version
9.9 (Critical) / CVSS v3.1
Updated2026-10-23
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Prose
attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
canonical lxd
Classified as
CWE-59 (Improper Link Resolution Before File Access ('Link Following'))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
canonicallxd
SubsystemsGeneral OT
SectorsMultiple

What to Know

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system. (NVD)

What to Do

Monitor canonical's web page for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-63293
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-63293
Vendor advisoryhttps://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE
Report compilation © 2026 OT-Advisories.com  ·  CC BY 4.0  ·  Source materials remain the property of their respective publishers as cited.