This vulnerability in LXD's instance template processing involves improper limitation of pathname to a restricted directory (CWE-22). Specifically, when processing target template paths specified in metadata.yaml, LXD performs validation against a confined os.Root directory handle but subsequently uses os.Create with an unconfined string path to open and create files. This discrepancy allows attackers with container edit permissions or users launching crafted images to escape directory confinement, overwrite root-owned files on the host, and achieve host root code execution. The vulnerability affects multiple versions of LXD, including 4.0.0, 5.0.0, 5.21.0, 6.0, and version ranges >=4.0.0 <4.0.13, >=5.0.0 <5.0.9, >=5.21.0 <5.21.7, and >=6.0 <6.10. The CVSS v3.1 score is 9.9, indicating critical severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with container edit permissions or any user launching a crafted image to overwrite arbitrary files on the host system as root. This leads to full host root code execution, compromising the host's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict container edit permissions to trusted users only and avoid launching untrusted images.