This vulnerability (CWE-22) exists in the unpackVolume function of the Btrfs storage driver in Canonical LXD. An authenticated user who can create instances can exploit a path traversal flaw by crafting the subvolumes[].path entry in the backup/optimized_header.yaml file during a btrfs optimized backup import. This allows the attacker to delete or replace arbitrary files and directories on the host filesystem with root privileges. The flaw affects LXD versions >=4.0.0 <4.0.14, >=5.0.0 <5.0.10, >=5.21.0 <5.21.8, and >=6.0 <6.10.

Successful exploitation results in full root-level control over the host filesystem, enabling deletion or replacement of arbitrary files and directories. This can lead to complete system compromise, data loss, or persistent unauthorized access. The CVSS v3.1 score is 9.9 (critical), reflecting the high impact on confidentiality, integrity, and availability.

Patch your LXD installations to versions at or beyond the fixed releases: 4.0.14, 5.0.10, 5.21.8, and 6.10. Since this is a local privilege vulnerability requiring instance creation privileges, restricting such privileges to trusted users can reduce risk until patched. Patch status is confirmed by the affected version ranges indicating fixed versions. No vendor advisory content was provided, so check Canonical's official security advisories for the latest remediation guidance.