{"schemaVersion":3,"id":"CVE-2026-66897","aliases":["UBUNTU-CVE-2026-66897","DEBIAN-CVE-2026-66897"],"status":"published","duplicateOf":null,"title":null,"description":"A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.","dates":{"published":"2026-08-24T09:08:04.188Z","modified":"2026-08-25T03:55:49.930Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.9,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":7.9,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":7.9,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00717,"percentile":0.52964,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.049,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00668},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00717,"percentile":0.52964}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00668,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00717,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00717,"percentile":0.52964}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_CANONICAL_LXD","name":"Lxd","source":"github","url":"https://github.com/canonical/lxd/security/advisories/GHSA-4c49-9fpc-hc3v","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"},{"id":"CWE-23","name":"Relative Path Traversal","description":"The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as \"..\" that can resolve to a location that is outside of that directory.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/23.html"}],"affected":[{"vendor":"canonical","product":"lxd","name":"lxd","label":"lxd","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.0.0, < 4.0.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.21.0, < 5.21.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0, < 6.10","noFixRecorded":false,"fixedIn":null},{"text":"< 4.0.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0, < 5.0.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.1, < 5.21.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0, ≤ 6.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.0.0, < 4.0.13 | ≥ 5.21.0, < 5.21.7 | ≥ 6.0, < 6.10 | < 4.0.13 | ≥ 5.0.0, < 5.0.9 | ≥ 5.1, < 5.21.7 | ≥ 6.0, ≤ 6.9","eol":null,"hubHref":"/vendor/canonical/lxd"},{"vendor":"debian","product":"lxd","name":"lxd","label":"lxd","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/lxd","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"lxd","name":"lxd","label":"lxd","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/lxd","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv","label":"github.com/canonical/lxd/security/advisories/GHSA-q39m-8fx9-42fv","hostname":"github.com","tags":["VDB Entry","Vendor Advisory","REPORT","Exploit"]},{"url":"https://ubuntu.com/security/CVE-2026-66897","label":"ubuntu.com/security/CVE-2026-66897","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66897","label":"www.cve.org/CVERecord?id=CVE-2026-66897","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-66897","label":"security-tracker.debian.org/tracker/CVE-2026-66897","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-08-24T09:08:04.188Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-25T03:55:49.930Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:38:09.528Z","stale":false,"partial":false}}