CVE-2026-85526
CVE-2026-85526 · Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.
CVSS 9.9 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
lxd
- Versions
- ≥ 4.0.0, < 4.0.14: Affected (semver)
- ≥ 5.0.0, < 5.0.10: Affected (semver)
- ≥ 5.21.0, < 5.21.8: Affected (semver)
- ≥ 6.0, < 6.10: Affected (semver)
Update to 4.0.14; Update to 5.0.10; Update to 5.21.8; Update to 6.10
incus Debian:13
- Versions
- 6.0.4-2
- 6.0.4-2+deb13u1~bpo12+1
- Affected ranges
- ECOSYSTEM: < 6.0.4-2+deb13u1
Update to 6.0.4-2+deb13u1
incus Debian:14
- Versions
- 6.0.4-2
- 6.0.4-3
- 6.0.5-1
- 6.0.5-2
- 6.0.5-3
- 6.0.5-4
- 6.0.5-5
- 6.0.5-6
- 6.0.5-7
- 6.0.5-8
- 6.0.6-1
- 6.0.6-2
- 6.0.6-3
- 6.14.0-1~exp1
- 6.15.0-1~exp1
- 6.16.0-1~exp1
- 6.17.0-1~exp1
- 6.20.0-1~exp1
- 6.21.0-1~exp1
- 6.22.0-1~exp1
- 6.23.0-1~exp1
- 7.0.0-1
- 7.0.0-1~bpo13+1
- 7.0.0-2
- 7.0.0-2~bpo13+1
- 7.0.0-3
- 7.0.0-4
- 7.0.0-5
- 7.0.0-5~bpo13+1
- 7.0.1-1
- 7.0.1-1~bpo13+1
- 7.0.1-2
- 7.0.1-2~bpo13+1
- 7.0.1-3
- 7.0.1-3~bpo13+1
- 7.0.1-4
- Affected ranges
- ECOSYSTEM: < 7.0.1-5
Update to 7.0.1-5
lxd Debian:12
- Versions
- 5.0.2+git20231211.1364ae4-1
- 5.0.2+git20231211.1364ae4-2
- 5.0.2+git20231211.1364ae4-3
- 5.0.2+git20231211.1364ae4-4
- 5.0.2+git20231211.1364ae4-5
- 5.0.2+git20231211.1364ae4-6
- 5.0.2+git20231211.1364ae4-7
- 5.0.2+git20231211.1364ae4-8
- 5.0.2+git20231211.1364ae4-9
- 5.0.2-5
- 5.0.2-5+deb12u1
- 5.0.2-5+deb12u2
- 5.0.2-5+deb12u3
- 5.0.2-5+deb12u4
- 5.0.2-5+deb12u5
- 5.0.2-5+deb12u6
- 5.0.2-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Debian:13
- Versions
- 5.0.2+git20231211.1364ae4-9
- 5.0.2+git20231211.1364ae4-9+deb13u1
- 5.0.2+git20231211.1364ae4-9+deb13u2
- 5.0.2+git20231211.1364ae4-9+deb13u3
- 5.0.2+git20231211.1364ae4-9+deb13u4
- 5.0.2+git20231211.1364ae4-9+deb13u5
- 5.0.2+git20231211.1364ae4-9+deb13u6
- 5.0.2+git20231211.1364ae4-9+deb13u7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:Pro:16.04:LTS
- Versions
- 0.20-0ubuntu4
- 0.21-0ubuntu3
- 0.21-0ubuntu5
- 0.22-0ubuntu1
- 0.22-0ubuntu2
- 0.23-0ubuntu1
- 0.23-0ubuntu2
- 0.23-0ubuntu3
- 0.24-0ubuntu2
- 0.24-0ubuntu3
- 0.24-0ubuntu4
- 0.25-0ubuntu1
- 0.26-0ubuntu2
- 0.26-0ubuntu3
- 0.27-0ubuntu1
- 0.27-0ubuntu2
- 2.0.0~beta1-0ubuntu3
- 2.0.0~beta1-0ubuntu4
- 2.0.0~beta2-0ubuntu1
- 2.0.0~beta2-0ubuntu2
- 2.0.0~beta3-0ubuntu1
- 2.0.0~beta3-0ubuntu2
- 2.0.0~beta3-0ubuntu3
- 2.0.0~beta3-0ubuntu4
- 2.0.0~beta4-0ubuntu1
- 2.0.0~beta4-0ubuntu2
- 2.0.0~beta4-0ubuntu3
- 2.0.0~beta4-0ubuntu4
- 2.0.0~beta4-0ubuntu5
- 2.0.0~beta4-0ubuntu6
- 2.0.0~beta4-0ubuntu7
- 2.0.0~rc1-0ubuntu1
- 2.0.0~rc1-0ubuntu2
- 2.0.0~rc1-0ubuntu3
- 2.0.0~rc2-0ubuntu2
- 2.0.0~rc2-0ubuntu3
- 2.0.0~rc3-0ubuntu1
- 2.0.0~rc3-0ubuntu2
- 2.0.0~rc3-0ubuntu3
- 2.0.0~rc3-0ubuntu4
- 2.0.0~rc4-0ubuntu1
- 2.0.0~rc5-0ubuntu1
- 2.0.0~rc6-0ubuntu1
- 2.0.0~rc6-0ubuntu2
- 2.0.0~rc7-0ubuntu1
- 2.0.0~rc7-0ubuntu2
- 2.0.0~rc8-0ubuntu1
- 2.0.0~rc8-0ubuntu2
- 2.0.0~rc8-0ubuntu3
- 2.0.0~rc8-0ubuntu5
- 2.0.0~rc8-0ubuntu6
- 2.0.0~rc8-0ubuntu7
- 2.0.0~rc9-0ubuntu2
- 2.0.0~rc9-0ubuntu3
- 2.0.0~rc9-0ubuntu4
- 2.0.0~rc9-0ubuntu5
- 2.0.0-0ubuntu1
- 2.0.0-0ubuntu2
- 2.0.0-0ubuntu3
- 2.0.0-0ubuntu4
- 2.0.1-0ubuntu1~16.04.1
- 2.0.2-0ubuntu1~16.04.1
- 2.0.3-0ubuntu1~ubuntu16.04.2
- 2.0.4-0ubuntu1~ubuntu16.04.1
- 2.0.5-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.2
- 2.0.9-0ubuntu1~16.04.1
- 2.0.9-0ubuntu1~16.04.2
- 2.0.10-0ubuntu1~16.04.1
- 2.0.10-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.4
- 2.0.11-0ubuntu1~16.04.4+esm1
- 2.0.11-0ubuntu1~16.04.4+esm2
- 2.0.11-0ubuntu1~16.04.4+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:Pro:18.04:LTS
- Versions
- 2.18-0ubuntu6
- 2.19-0ubuntu1
- 2.20-0ubuntu3
- 2.20-0ubuntu4
- 2.21-0ubuntu1
- 2.21-0ubuntu2
- 2.21-0ubuntu3
- 2.21-0ubuntu4
- 3.0.0~beta2-0ubuntu3
- 3.0.0~beta3-0ubuntu3
- 3.0.0~beta5-0ubuntu2
- 3.0.0~beta7-0ubuntu1
- 3.0.0-0ubuntu1
- 3.0.0-0ubuntu2
- 3.0.0-0ubuntu3
- 3.0.0-0ubuntu4
- 3.0.1-0ubuntu1~18.04.1
- 3.0.2-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.2
- 3.0.3-0ubuntu1~18.04.2+esm1
- 3.0.3-0ubuntu1~18.04.2+esm2
- 3.0.3-0ubuntu1~18.04.2+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:20.04:LTS
- Versions
- 1:0.7
- 1:0.8
- 1:0.9
- 1:0.10
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
incus Ubuntu:Pro:24.04:LTS
- Versions
- 0.4-1ubuntu1
- 0.5.1-1
- 0.5.1-3
- 0.6-1
- 6.0.0-1
- 6.0.0-1ubuntu0.1
- 6.0.0-1ubuntu0.2
- 6.0.0-1ubuntu0.2+esm1
- 6.0.0-1ubuntu0.3
- 6.0.0-1ubuntu0.3+esm1
- 6.0.0-1ubuntu0.3+esm2
- 6.0.0-1ubuntu0.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
incus Ubuntu:26.10
- Versions
- 6.0.5-8
- 7.0.1-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
incus Ubuntu:Pro:26.04:LTS
- Versions
- 6.0.4-2
- 6.0.5-8
- 6.0.5-8ubuntu0.26.04.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rv
- https://github.com/canonical/lxd-private/pull/87
- https://github.com/canonical/lxd-private/pull/105
- https://github.com/canonical/lxd-private/pull/104
- https://github.com/canonical/lxd-private/pull/103
- https://github.com/canonical/lxd-private/pull/84
- https://nvd.nist.gov/vuln/detail/CVE-2026-85526