CVE-2026-85185 Details
Description
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.
A path traversal vulnerability has been identified in the Btrfs storage driver of Canonical LXD, affecting versions 4.0.2 and later, and prior to the patched versions 4.0.14, 5.0.10, 5.21.8 and 6.10. This vulnerability allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On systems where the root filesystem is Btrfs, it also enables the client to place attacker-controlled content at arbitrary host paths, potentially leading to full host compromise. The issue arises because the Btrfs storage driver does not properly validate subvolume paths before using them in filesystem operations, allowing traversal sequences to escape the intended directory structure and access sensitive areas of the filesystem.
Users can upgrade to LXD versions 4.0.14, 5.0.10, 5.21.8 or 6.10 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 28, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/canonical/lxd/security/advisories/GHSA-27q7-qwhm-c34p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Canonical LXD | <= 6.9 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 28, 2026 | New CVE Received | [email protected] |