Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2026-86334

CLI Path Traversal via Content-Disposition in LXD Image Export/Copy

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical LXD

Default version status: unaffected

  • 4.0.2 to < 4.0.14affected
  • 5.0.0 to < 5.0.10affected
  • 5.21.0 to < 5.21.8affected
  • 6.0 to < 6.10affected

References