CVE-2026-63294: canonical lxd Link Following
Vulnerability summary
CVE-2026-63294 is a critical (CVSS 9.9) Link Following vulnerability in canonical lxd. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
-0.34 pp
From 1.21% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLxd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- lxd≥ 5.21.0, < 5.21.6 | ≥ 4.0.0, < 4.0.12 | ≥ 5.0.0, < 5.0.8 | ≥ 5.1, < 5.21.6 | ≥ 6.0, < 6.10
Debian1 product
- lxdAll versions (No fix recorded)
Ubuntu1 product
- lxdAll versions (No fix recorded)
3 vendors · 3 products
References
4 links- github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4mVDB EntryVendor AdvisoryREPORTThird Party AdvisoryExploitMitigation
