Medium severity · published Sep 28, 2026
CVE-2026-86334
CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
4.2
CVSS
0.3%
EPSS
No
On KEV
Description
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LX
LXD · Canonical
4.0.2 before 4.0.14; 5.0.0 before 5.0.10; 5.21.0 before 5.21.8; 6.0 before 6.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86334
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86334
vendor-advisory
https://github.com/canonical/lxd/security/advisories/GHSA-g4cm-f533-78hq
patch
https://github.com/canonical/lxd/pull/18977
patch
https://github.com/canonical/lxd/pull/18976
patch
https://github.com/canonical/lxd/pull/18974
patch
https://github.com/canonical/lxd/pull/18975
patch
https://github.com/canonical/lxd/pull/18940
More from LXD
9.9
CVE-2026-87799
Arbitrary file write on LXD host via symlink in migration stream
9.9
CVE-2026-85526
Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
9.9
CVE-2026-66897
Instance template path traversal allows arbitrary host file write as root
9.9
CVE-2026-66898
Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
9.9
CVE-2026-63293
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root