NetSight
IP …
medium4.2

CVE-2026-86334

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allow…

Impact

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

Affected products

ProductAffected versions
Canonical LXD From 4.0.2
before 4.0.14

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

CWE-22

References