All vulnerabilities
CVE-2026-86334GHSA-g4cm-f533-78hq

CLI Path Traversal via Content-Disposition in LXD Image Export/Copy

Canonical LXD
Open in ThreatlineRecord JSON
CVSS
4.2Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.0.14Also 5.0.10, 5.21.8 and 2 moreCVE List
Published28 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

Text from CVE List

Affected versions 5

  • LXDaffected: 4.0.2 before 4.0.14CVE List
  • LXDaffected: 5.0.0 before 5.0.10CVE List
  • LXDaffected: 5.21.0 before 5.21.8CVE List
  • LXDaffected: 6.0 before 6.10CVE List
  • lxd>= 4.0.2GitHub

References 6