CVE-2026-66898: Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-12 · updated 2026-10-24
Weakness: CWE-22

Description

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.

Affected products

Canonical LXD: from 4.0.0 before 4.0.12; from 5.0.0 before 5.0.4; from 5.1 before 5.21.2; 6.0 — fixed in 4.0.12, 5.0.4, 5.21.2

How to fix

Upgrade to a fixed version: Canonical LXD 4.0.12, 5.0.4, 5.21.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66898 or the next vulnerability affects your stack