Vulnetix
Try Vulnetix Request Demo
CVE-2026-28384 PUBLISHED CVSS 9.399999618530273 CRITICAL

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

EPSS 0.13% · 32.4th percentile

Risk Scores

CVSS v4.0
9.399999618530273
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS Score
0.13%
32.4th percentile

Affected Products

VendorProductVersions
Canonicallxd6.0, 5.21.0, 5.0.0

Timeline

References

Open in Interactive Console →