CVE-2026-63294

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63294", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-07-16T09:49:29.911Z", "datePublished": "2026-08-12T19:57:07.898Z", "dateUpdated": "2026-08-13T12:38:48.134Z"}, "containers": {"cna": {"title": "Root RCE via image backup.yaml symlink", "descriptions": [{"lang": "en", "value": "A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges."}], "affected": [{"vendor": "Canonical", "product": "LXD", "packageName": "LXD", "platforms": ["Linux"], "repo": "https://github.com/canonical/lxd", "defaultStatus": "unaffected", "versions": [{"version": "4.0.0", "status": "affected", "versionType": "semver", "lessThan": "4.0.12"}, {"version": "5.0.0", "status": "affected", "versionType": "semver", "lessThan": "5.0.8"}, {"version": "5.21.0", "status": "affected", "versionType": "semver", "lessThan": "5.21.6"}, {"version": "6.0", "status": "affected", "versionType": "semver", "lessThan": "6.10"}]}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')", "cweId": "CWE-59"}]}], "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "Symlink Symbolic Link Execution"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m", "tags": ["vdb-entry", "vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "source": {"discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to LXD version 4.0.12 or later, 5.0.8 or later, or 5.12.6 or later, or 6.10 or later."}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T19:57:07.898Z"}}, "adp": [{"references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T12:38:32.604341Z", "id": "CVE-2026-63294", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T12:38:48.134Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63294", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T12:38:32.604341Z"}}}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T12:38:43.106Z"}}], "cna": {"title": "Root RCE via image backup.yaml symlink", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "Symlink Symbolic Link Execution"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "product": "LXD", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.12", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.8", "versionType": "semver"}, {"status": "affected", "version": "5.21.0", "lessThan": "5.21.6", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.10", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "LXD", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to LXD version 4.0.12 or later, 5.0.8 or later, or 5.12.6 or later, or 6.10 or later."}], "references": [{"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m", "tags": ["vdb-entry", "vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-12T19:57:07.898Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63294", "state": "PUBLISHED", "dateUpdated": "2026-08-13T12:38:48.134Z", "dateReserved": "2026-07-16T09:49:29.911Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-08-12T19:57:07.898Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "LXD", "platforms": ["Linux"], "product": "LXD", "repo": "https://github.com/canonical/lxd", "vendor": "Canonical", "versions": [{"lessThan": "4.0.12", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "5.0.8", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "5.21.6", "status": "affected", "version": "5.21.0", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "89DC62EE-69CD-4ACD-BB83-6A0635AC341C", "versionEndExcluding": "4.0.12", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "59D070D6-84D2-400E-8260-EA52E5C60D37", "versionEndExcluding": "5.0.8", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "575036D1-2B55-4043-B94A-1584E3F2DA37", "versionEndExcluding": "5.21.6", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*", "matchCriteriaId": "374F5622-1D8F-4EF9-97E6-736C8220623B", "versionEndExcluding": "6.10", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges."}, {"lang": "es", "value": "Una vulnerabilidad de seguimiento de enlaces en LXD permite a un atacante lograr la ejecuci\u00f3n de comandos como root en el sistema anfitri\u00f3n. Durante la importaci\u00f3n o descompresi\u00f3n de archivos de imagen o de copia de seguridad manipulados, LXD no valida ni confina correctamente el archivo backup.yaml cuando este existe como un enlace simb\u00f3lico. Un atacante puede explotar esta falla proporcionando un archivo malicioso con un archivo backup.yaml con enlace simb\u00f3lico, lo que hace que LXD procese metadatos de configuraci\u00f3n no confinados y ejecute comandos arbitrarios con privilegios de root."}], "id": "CVE-2026-63294", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63294", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T12:38:32.604341Z", "version": "2.0.3"}}]}, "published": "2026-08-12T20:17:47.187", "references": [{"source": "security@ubuntu.com", "tags": ["Third Party Advisory", "Exploit", "Mitigation"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory", "Exploit", "Mitigation"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.12)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.8)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[5.21.0,5.21.6)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[6.0,6.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LXD", "source": "cna", "vendor": "Canonical"}, "product": "lxd", "vendor": "canonical"}], "created": "2026-08-12T21:45:10.181952+00:00", "updated": "2026-08-13T15:00:04.237048+00:00", "vendors": ["canonical", "canonical$PRODUCT$lxd"]}