CVE-2026-86334: Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms…

PriorityP427medium4.2CVSS 3.1

AVNACHPRNUIRSUCNILAL

EPSS

0.34%

25.7th percentile

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
canonical	lxd	>= 4.0.2 < 4.0.14	4.0.14
canonical	lxd	>= 5.0.0 < 5.0.10	5.0.10
canonical	lxd	>= 5.21.0 < 5.21.8	5.21.8
canonical	lxd	>= 6.0 < 6.10	6.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.