This vulnerability (CVE-2026-63294) in Canonical LXD is a link following flaw (CWE-59) where LXD fails to properly validate symbolic links during the import or unpacking of crafted image or backup archives. The backup.yaml file, if provided as a symbolic link, is not confined correctly, allowing an attacker to execute arbitrary commands with root privileges on the host system. The issue affects multiple versions of LXD, including 4.0.0, 5.0.0, 5.21.0, 6.0, and all versions in specified ranges prior to fixed versions. The CVSS 3.1 base score is 9.9, indicating a critical severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation results in root command execution on the host system, compromising confidentiality, integrity, and availability at the highest level. This allows an attacker with limited privileges to escalate to full root control over the host running LXD, potentially leading to complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor Canonical's advisories for patches addressing this vulnerability and avoid importing untrusted image or backup archives until a fix is available.