CVE-2026-85526

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

CVE-2026-85185 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

EUVD-2026-88258

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

CVE-2026-85185

Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8, and 6.10) on Linux are vulnerable to a path traversal flaw in the btrfs storage driver . An authenticated client with instance creation permissions can use crafted subvolume paths containing ../ sequences to delete arbitrary...

EUVD-2026-88257

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

CVE-2026-85526

A path traversal vulnerability exists in the Btrfs storage driver (specifically the unpackVolume function) within Canonical LXD on Linux. An authenticated user with instance creation privileges can manipulate the host filesystem as root by providing a crafted subvolumes[].path entry in backup/opt...