A vulnerability in LXD (Incus) allows bypassing project restrictions that are intended to block low-level container operations. Specifically, instance snapshots ignore the 'restricted.containers.lowlevel=block' setting, enabling attackers to abuse low-level hooks like 'raw.lxc' and 'raw.qemu' to execute arbitrary commands on the host with root privileges. This can be exploited by crafting a malicious snapshot locally and restoring it in a restricted project on a remote server, resulting in full command execution on the Incus server.