Path Traversal Flaw in LXD's Instance Template Processing by Canonical

CVE-2026-66897

What is CVE-2026-66897?

A path traversal vulnerability has been identified in LXD's instance template processing, allowing individuals with container edit permissions, or users launching crafted images, to overwrite arbitrary files on the host system with root privileges. This flaw arises due to improper validation of target template paths in metadata.yaml, where LXD initially validates paths against a confined os.Root directory but then uses an unconfined string path for file operations through os.Create. This mismatch enables an attacker to bypass directory restrictions, potentially leading to unauthorized file modifications and host root code execution.

References