← All Advisories
Reported from OT-Advisories.com as of

CVE-2026-66898

Last refreshed2026-10-23

Status: UPDATED  |  Advisory ID: CVE-2026-66898

Key Details

CVECVE-2026-66898
CVSS Score / Version
9.9 (Critical) / CVSS v3.1
Updated2026-10-23
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Prose
attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
canonical lxd
Classified as
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
canonicallxd
SubsystemsGeneral OT
SectorsMultiple

What to Know

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory. (NVD)

What to Do

Monitor canonical's web page for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-66898
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-66898
Vendor advisoryhttps://github.com/canonical/lxd/security/advisories/GHSA-m857-c7gc-c984

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE
Report compilation © 2026 OT-Advisories.com  ·  CC BY 4.0  ·  Source materials remain the property of their respective publishers as cited.