CVE-2026-85185: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Canonical LXD
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.
AI Analysis
Technical Summary
CVE-2026-85185 is a path traversal vulnerability (CWE-22) in the btrfs storage driver of Canonical LXD. Authenticated clients with instance creation permissions can exploit this flaw by sending crafted subvolume paths with '../' sequences in either the optimized_header.yaml of a btrfs backup or the btrfs migration header. This allows deletion of arbitrary files on the host with root privileges. On systems where the root filesystem is btrfs, the attacker can also write attacker-controlled content to arbitrary host paths, leading to full host compromise. The vulnerability affects LXD versions >=4.0.2 <4.0.14, >=5.0.0 <5.0.10, >=5.21.0 <5.21.8, and >=6.0 <6.10. Fixes are available in versions 4.0.14, 5.0.10, 5.21.8, and 6.10.
Potential Impact
An authenticated client with permission to create instances can delete arbitrary files on the host as root, which can disrupt system integrity and availability. On hosts with btrfs as the root filesystem, the attacker can also place malicious content at arbitrary paths, potentially leading to full host compromise. This elevates the impact to critical, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
Fixes are available in Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.10. Users should upgrade to these versions or later to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.
CVE-2026-85185: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Canonical LXD
Description
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.
CVSS v3.1
Score 9.6critical
Affected software
Canonical
LXD
pkg:github/LXDRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85185 is a path traversal vulnerability (CWE-22) in the btrfs storage driver of Canonical LXD. Authenticated clients with instance creation permissions can exploit this flaw by sending crafted subvolume paths with '../' sequences in either the optimized_header.yaml of a btrfs backup or the btrfs migration header. This allows deletion of arbitrary files on the host with root privileges. On systems where the root filesystem is btrfs, the attacker can also write attacker-controlled content to arbitrary host paths, leading to full host compromise. The vulnerability affects LXD versions >=4.0.2 <4.0.14, >=5.0.0 <5.0.10, >=5.21.0 <5.21.8, and >=6.0 <6.10. Fixes are available in versions 4.0.14, 5.0.10, 5.21.8, and 6.10.
Potential Impact
An authenticated client with permission to create instances can delete arbitrary files on the host as root, which can disrupt system integrity and availability. On hosts with btrfs as the root filesystem, the attacker can also place malicious content at arbitrary paths, potentially leading to full host compromise. This elevates the impact to critical, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
Fixes are available in Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.10. Users should upgrade to these versions or later to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- canonical
- Date Reserved
- 2026-09-03T11:46:34.569Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aba6c9ef7a7c54106b98906
Added to database: 09/28/2026, 13:33:18 UTC
Last enriched: 09/28/2026, 13:48:07 UTC
Last updated: 09/29/2026, 01:57:22 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.