CVE-2026-16033

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16033", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-07-17T08:44:31.450Z", "datePublished": "2026-08-12T20:11:08.781Z", "dateUpdated": "2026-08-13T12:46:08.117Z"}, "containers": {"cna": {"title": "Arbitrary file read+write on host via templates/ symlink in malicious image", "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system."}], "affected": [{"vendor": "Canonical", "product": "LXD", "packageName": "LXD", "platforms": ["Linux"], "repo": "https://github.com/canonical/lxd", "defaultStatus": "unaffected", "versions": [{"version": "4.0.0", "status": "affected", "versionType": "semver", "lessThan": "4.0.12"}, {"version": "5.0.0", "status": "affected", "versionType": "semver", "lessThan": "5.0.8"}]}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "Path Traversal"}]}, {"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "Input Data Manipulation"}]}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh", "tags": ["vdb-entry", "vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to LXD version 4.0.12 or later, or 5.0.8 or later."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T20:11:08.781Z"}}, "adp": [{"references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T12:45:51.004847Z", "id": "CVE-2026-16033", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T12:46:08.117Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16033", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T12:45:51.004847Z"}}}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T12:46:03.451Z"}}], "cna": {"title": "Arbitrary file read+write on host via templates/ symlink in malicious image", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "Path Traversal"}]}, {"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.12", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.8", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to LXD version 4.0.12 or later, or 5.0.8 or later."}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh", "tags": ["vdb-entry", "vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T20:11:08.781Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16033", "state": "PUBLISHED", "dateUpdated": "2026-08-13T12:46:08.117Z", "dateReserved": "2026-07-17T08:44:31.450Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-08-12T20:11:08.781Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "LXD", "platforms": ["Linux"], "product": "LXD", "repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "versions": [{"lessThan": "4.0.12", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "5.0.8", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "89DC62EE-69CD-4ACD-BB83-6A0635AC341C", "versionEndExcluding": "4.0.12", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "C358ED3B-0384-494A-A494-18A37947E057", "versionEndExcluding": "5.0.7", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en LXD permite a un atacante lograr la lectura arbitraria de archivos del host o la creaci\u00f3n de archivos sin restricciones. Al procesar plantillas de metadatos de imagen, LXD no logra sanear o restringir adecuadamente las rutas de archivo de plantilla para que no escapen del directorio de plantillas de instancia (afectyo espec\u00edficamente las rutas de ejecuci\u00f3n del controlador de m\u00e1quina virtual / QEMU). Un atacante puede explotar esta falla al proporcionar un archivo de imagen manipulado con directivas de plantilla maliciosas que contienen secuencias de salto de ruta, lo que hace que LXD acceda o escriba archivos fuera del directorio de plantillas previsto en el sistema host."}], "id": "CVE-2026-16033", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16033", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T12:45:51.004847Z", "version": "2.0.3"}}]}, "published": "2026-08-12T21:17:35.880", "references": [{"source": "security@ubuntu.com", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.12)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LXD", "source": "cna", "vendor": "Canonical"}, "product": "lxd", "vendor": "canonical"}], "created": "2026-08-12T22:15:06.519507+00:00", "updated": "2026-08-12T22:30:09.822088+00:00", "vendors": ["canonical", "canonical$PRODUCT$lxd"]}