VDB
CVE-2026-63293
CVE-2026-63293
PUBLISHED
CVSS 9.9 CRITICAL
Reported by canonical · Published August 12, 2026
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
Risk Scores
CVSS 3.1
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | LXD | 4.0.0, 5.0.0, 5.21.0 |
| Canonical | LXD | 4.0.0, 5.0.0, 5.21.0 |
Timeline
- Aug 12, 2026 CVE Published
- Aug 13, 2026 Coalition ESS Score
- Aug 13, 2026 CVE Updated
- Aug 20, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 4, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score