CVE-2026-16033

Received Received - Intake

Path Traversal in LXD Virtual Machine Driver

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Canonical Ltd.

Description

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-16033

EUVD

EUVD-2026-57547

Affected Vendors & Products

Vendor	Product	Version / Range
ubuntu	lxd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in LXD that lets an attacker read arbitrary files on the host or create files outside the intended directory. It occurs when LXD processes image metadata templates and fails to properly restrict file paths, allowing path traversal sequences like '../' to escape the templates directory.

Impact Analysis

An attacker could exploit this to access sensitive files on the host system, such as configuration files, credentials, or other confidential data. They could also create unauthorized files, potentially leading to system compromise or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR or HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Update LXD to the latest patched version immediately to address the path traversal flaw. Restrict access to LXD instances and image uploads to trusted users only. Monitor file system changes and unauthorized access attempts on the host system.

Hi! I’m here to help you understand CVE-2026-16033. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70