CVE-2026-85526
Deferred Deferred - Pending Action

Path Traversal in Canonical LXD via Btrfs Backup Import

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Canonical Ltd.

Description
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-85526
EUVD
EUVD-2026-88257

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
canonical lxd From 4.0.2 (inc)
canonical lxd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85526 is a path traversal vulnerability in Canonical LXD's Btrfs storage driver. It allows an authenticated user with instance creation privileges to delete or replace arbitrary files on the host filesystem as root by exploiting a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Detection Guidance

To detect this vulnerability, check for unauthorized file modifications or deletions in system directories like /etc, /var, or /usr. Review LXD logs for backup import operations with suspicious subvolume paths. Commands to inspect include: 'sudo ls -la /var/snap/lxd/common/lxd/logs/' for logs, 'sudo find / -type f -mtime -1' for recent file changes, and 'sudo lxc storage list' to check storage pools. Monitor for unexpected instance creation by users with can_create_instances privileges.

Impact Analysis

This vulnerability enables an attacker to perform root-level operations on the host filesystem, including arbitrary file deletion or directory replacement. This could lead to system compromise, data loss, or unauthorized modifications to critical system files.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations may face legal and regulatory penalties if exploited.

Mitigation Strategies

Immediately update LXD to a patched version. Restrict can_create_instances privileges to administrators only. Avoid importing untrusted btrfs optimized backups. Verify backup sources before import. Temporarily disable btrfs optimized backup functionality if not critical. Monitor filesystem integrity and audit user activities with backup import permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85526. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart