CVE-2026-66898Salto de directorio crítico en LXD vía importación de backups
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.
Ver en NVDAnálisis
A critical vulnerability in LXD's backup import mechanism allows attackers to escape the container boundary via path traversal. By providing a crafted backup archive, an attacker can overwrite arbitrary files on the host server, likely leading to full root access.
Roles relevantes
Severidad
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCWE-22EPSS
Sin puntaje EPSS aún (CVE muy reciente).
Descripción técnica
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.