CVE-2026-63294

Root RCE via image backup.yaml symlink

State: Published
Severity: 9.9 Critical
Published: Aug 12, 2026
Updated: Aug 13, 2026
Reserved: Jul 16, 2026

Description

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	canonical

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

Product	Versions
LXDCanonical	4.0.0 to before 4.0.12Affected 5.0.0 to before 5.0.8Affected 5.21.0 to before 5.21.6Affected 6.0 to before 6.10Affected

References

https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4mvdb-entryvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.