CVE-2026-63293: canonical lxd Link Following
Vulnerability summary
CVE-2026-63293 is a critical (CVSS 9.9) Link Following vulnerability in canonical lxd. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.11 pp
From 0.48% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLxd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- lxd≥ 5.0.0, < 5.0.8 | ≥ 5.21.0, < 5.21.6 | ≥ 6.0, < 6.10 | ≥ 4.0.0, < 4.0.12
Debian1 product
- lxdAll versions (No fix recorded)
Ubuntu1 product
- lxdAll versions (No fix recorded)
3 vendors · 3 products
References
4 links- github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5VDB EntryVendor AdvisoryREPORTExploit
