CVE-2026-66897

Last refreshed2026-10-24

Status: UPDATED | Advisory ID: CVE-2026-66897

Key Details

CVE	CVE-2026-66897
CVSS Score / Version	9.9 (Critical) / CVSS v3.1
Updated	2026-10-23
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	canonical lxd
Classified as	CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
canonical	lxd

Vendor

Product

Affected Versions

Patch Status

canonical

lxd

Subsystems	General OT
Sectors	Multiple

What to Know

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution. (NVD)

What to Do

Monitor canonical's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-66897
CVE	https://www.cve.org/CVERecord?id=CVE-2026-66897
Vendor advisory	https://github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-66897

CVE

https://www.cve.org/CVERecord?id=CVE-2026-66897

Vendor advisory

https://github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv