CVE-2026-85526

9.9 Critique

Publiée le 28/09/2026 à 16:17 · Modifiée le 29/09/2026 à 06:18 · Analyse NVD reportée · Source : security@ubuntu.com

Description

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Traduire en français

Produits concernés

Canonical LXD

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	security@ubuntu.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-22

Références

https://github.com/canonical/lxd-private/pull/103
https://github.com/canonical/lxd-private/pull/104
https://github.com/canonical/lxd-private/pull/105
https://github.com/canonical/lxd-private/pull/84
https://github.com/canonical/lxd-private/pull/87
https://github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rv

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories