CVE-2026-66898

creationtimestamp| type| source ---|---|--- 2026-08-12 21:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msw3776y2b2b 2026-08-12 22:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msw4x6wcer22...

CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...