A local privilege escalation vulnerability exists in LXD when an unprivileged user has root access to a container with a custom storage volume having the 'security.shifted' property set to true, and also has unprivileged access to the host. This allows such users to create a setuid binary inside the container that can be executed on the host to gain root privileges. Patches are available for multiple LXD series, and manual permission restrictions can mitigate the issue until patched versions are deployed.