Advisories · Technology
Canonical LXD.
Every CVE that names Canonical LXD among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 10.0 CriticalCritical · CVSS 9+
Improper certificate validation in the HTTPS listener in LXD
- Canonical LXD
- Weak cryptography or TLS
- CVSS 5.8 Medium
LXD client recursive file pull allows directory escape via malicious VM agent
- Canonical LXD
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
Arbitrary file write on LXD host via symlink in migration stream
- Canonical LXD
- Path traversal
- CVSS 7.7 High
Incorrect authorization in LXD storage volume API allows reading volumes from other projects
- Canonical LXD
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
- Canonical LXD
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
- Canonical LXD
- Path traversal
- CVSS 6.3 Medium
LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
- Canonical LXD
- Broken access control
- CVSS 4.2 Medium
CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
- Canonical LXD
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
Instance template path traversal allows arbitrary host file write as root
- Canonical LXD
- Path traversal
- CVSS 8.5 High
Arbitrary file read+write on host via templates/ symlink in malicious image
- Canonical LXD
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
- Canonical LXD
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
- Canonical LXD
- Path traversal
- CVSS 9.9 CriticalCritical · CVSS 9+
Root RCE via image backup.yaml symlink
- Canonical LXD
- Path traversal
- CVSS 4.3 Medium
Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
- Canonical LXD
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Project restriction bypass via instance migration config override
- Canonical LXD
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
- Canonical LXD
- Race condition
- Broken access control
- CVSS 8.7 High
LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration
- Canonical LXD
- Command injection
- CVSS 8.5 High
Storage volume cross-project move and snapshot restore bypass project disk limits
- Canonical LXD
- Denial of service
- CVSS 9.9 CriticalCritical · CVSS 9+
Cross-project cluster migration bypasses project restrictions via cluster notification flag
- Canonical LXD
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Cross-project instance move bypasses all project restrictions allowing host command execution
- Canonical LXD
- Broken access control
- CVSS 5.0 Medium
SSRF via image import from URL allows internal network probing by authenticated users
- Canonical lxd
- Server-side request forgery (SSRF)
- CVSS 7.2 High
LXD Snapshot Import Privilege Escalation Vulnerability
- Canonical LXD
- Broken access control
- CVSS 6.5 Medium
Authenticated Denial of Service via Malicious Backup Tarball in LXD
- Canonical LXD
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Authenticated RCE via unsanitized compression_algorithm
- Canonical lxd
- Command injection
- CVSS 4.8 Medium
Client-Side Path Traversal in LXD-UI
- Canonical LXD
- Path traversal