CRITICAL 9.9 NVD
CVE-2026-66898
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restorin
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.
References
This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-08-12 via NVD.
Risk Timeline
CVE Disclosed2026-08-12 · 0 days ago
Remediation Resources
vulnfeed aggregates 10530 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.