This vulnerability in LXD arises from improper limitation of pathnames (CWE-22) during backup import and restore processes. Specifically, LXD fails to validate instance and storage volume names contained in backup archive metadata, allowing an attacker to supply crafted names with path traversal sequences. Exploitation could lead to file system access or modification outside the designated restore directory, impacting confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 score of 9.9 (critical) with network attack vector, low attack complexity, requiring low privileges but no user interaction, and results in complete system compromise. Affected versions include 4.0.0, 5.0.0, 5.21.0, 6.0, and ranges >=4.0.0 <4.0.12, >=5.0.0 <5.0.4, >=5.21.0 <5.21.2, and >=6.0 <6.1. No official patch or remediation level is currently stated in the vendor advisory or data provided.

Successful exploitation allows an attacker with low privileges to perform path traversal during backup restore operations, potentially accessing or overwriting files outside the intended directory. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The critical CVSS score reflects the high impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid importing or restoring backups from untrusted sources to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.