Root RCE via image backup.yaml symlink (Canonical LXD)
En bref
- Source
- NVD
- EPSS
- EPSS 0.88 % · centile 59 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- canonical
- Statut NVD
- Analyzed
Description
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
Faiblesses (CWE)
- CWE-59 — Suivi de lien non maîtrisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | canonical |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · security@ubuntu.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-57538
- GCVE · GCVE-0-2026-63294
Configurations affectées (CPE NVD)
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.12cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.8cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*≥ 5.1 < 5.21.6cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*≥ 6.0 < 6.10
Produits affectés
| Produit | Versions |
|---|---|
| Canonical · LXD | affected 4.0.0 < 4.0.12 ; affected 5.0.0 < 5.0.8 ; affected 5.21.0 < 5.21.6 ; affected 6.0 < 6.10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |