CVE-2026-66897: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Canonical LXD

This vulnerability in LXD occurs during processing of target template paths specified in metadata.yaml. LXD validates the path against a confined os.Root directory handle but then opens and creates the file using os.Create with an unconfined string path. This discrepancy allows an attacker to bypass directory confinement, overwrite root-owned files on the host, and execute code as root on the host system. The vulnerability affects multiple versions of LXD including 4.0.0, 5.0.0, 5.21.0, 6.0, and all versions prior to 4.0.13, 5.0.9, 5.21.7, and 6.10 respectively. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability with scope change.

Successful exploitation allows an attacker with container edit permissions or the ability to launch a crafted image to overwrite arbitrary files on the host system with root privileges. This leads to full host compromise including root code execution, complete loss of confidentiality, integrity, and availability of the host system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict container edit permissions to trusted users only and avoid launching untrusted images. Monitor vendor communications for updates on remediation.