THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-66897 (CRITICAL 9.9) — A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yam

[NVD] CVE-2026-66897 (CRITICAL 9.9) — A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yam

mednvdPublished 2026-08-24

CVE-2026-66897 CVSS: 9.9 CRITICAL Published: 2026-08-24T10:16:39.767

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Ro

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-66897