CVE-2026-66898 in LXD
Summary
by MITRE • 08/12/2026
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical path traversal flaw in LXD container management software that directly impacts the security of containerized environments. The weakness stems from insufficient input validation during backup import and restore operations where LXD fails to properly sanitize instance and storage volume names contained within archive metadata. This design oversight creates an attack surface where malicious actors can manipulate file system paths through carefully crafted backup archives, potentially compromising the integrity and confidentiality of containerized workloads.
The technical implementation of this vulnerability aligns with CWE-23 Path Traversal and CWE-73 Path Traversal in Multiple Contexts, demonstrating how inadequate validation of user-supplied data can lead to arbitrary file access. During backup operations, LXD processes metadata from archive files without implementing proper path normalization or validation checks on the names of instances and storage volumes. Attackers can exploit this by creating backup archives containing malicious filenames such as ../../../etc/passwd or ../backup/data that contain directory traversal sequences. When these archives are imported or restored, the system processes these crafted paths without adequate sanitization, allowing attackers to traverse outside the intended restore directory boundaries.
The operational impact of this vulnerability extends beyond simple file access, potentially enabling complete system compromise through multiple attack vectors. An attacker could leverage this flaw to overwrite critical system files, inject malicious code into container environments, or access sensitive data stored in adjacent directories. The vulnerability affects both local and remote attack scenarios since LXD backup operations can be initiated through various interfaces including command line tools and API endpoints. This creates opportunities for privilege escalation attacks where unauthenticated users might gain access to host-level file systems, particularly when backup operations are performed with elevated privileges or when the system lacks proper isolation between containerized workloads and host resources.
Security professionals should implement immediate mitigations including restricting backup import permissions, validating all backup archive metadata before processing, and deploying network segmentation controls around LXD management interfaces. Organizations must also ensure that backup archives are validated through cryptographic signatures and that only trusted sources can initiate backup operations. The mitigation strategy should align with ATT&CK technique T1059 Command and Scripting Interpreter and T1078 Valid Accounts to prevent unauthorized access through compromised credentials or privilege escalation. Regular security assessments of container management systems should include vulnerability scanning for path traversal issues, and system administrators should implement proper logging and monitoring around backup operations to detect suspicious file access patterns that may indicate exploitation attempts.