Canonical LXD up to 4.0.13/5.0.9/5.21.7/6.8 Recursive File Pull Feature exposure of information through directory listing

Summaryinfo

A vulnerability was found in Canonical LXD up to 4.0.13/5.0.9/5.21.7/6.8. It has been rated as problematic. This affects an unknown part of the component Recursive File Pull Feature. This manipulation causes exposure of information through directory listing. This vulnerability is handled as CVE-2026-87798. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Canonical LXD up to 4.0.13/5.0.9/5.21.7/6.8 and classified as problematic. Affected by this vulnerability is an unknown function of the component Recursive File Pull Feature. The manipulation with an unknown input leads to a exposure of information through directory listing vulnerability. The CWE definition for the vulnerability is CWE-548. A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers. As an impact it is known to affect integrity. The summary by CVE is:

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-87798 since 09/09/2026. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1083 for this issue.

Upgrading to version 4.0.14, 5.0.10 or 5.21.8 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Canonical

Name

• LXD

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.21.0
• 5.21.1
• 5.21.2
• 5.21.3
• 5.21.4
• 5.21.5
• 5.21.6
• 5.21.7
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8

License

• open-source

Website

• Product: https://github.com/canonical/lxd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion