CVE-2026-86334

Executive Summary

CVE-2026-86334 is a path traversal vulnerability (CWE-22) in the LXD CLI client's image export and copy functionality, affecting Canonical LXD versions from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 across all platforms. A remote malicious or machine-in-the-middle image server can exploit this flaw by supplying a crafted filename in the Content-Disposition header during unified image export or copy operations into a local directory target. Successful exploitation allows overwriting arbitrary local files and potentially executing code on the client system, though the CVSS score of 4.2 reflects high attack complexity and required user interaction.

Technical Analysis

The vulnerability resides in the LXD CLI client's handling of image export and copy operations. When a user initiates a unified image export or copy operation to a local directory, the LXD client contacts a remote image server and processes the HTTP response. The image server can include a Content-Disposition header containing a filename parameter. Due to insufficient validation and sanitization of this filename parameter, a path traversal sequence (e.g., ../) can be embedded, allowing the server to dictate a file path that escapes the intended target directory.

This constitutes a classic CWE-22 path traversal issue: the client trusts the remote server's filename suggestion without properly constraining the resulting path to the designated download directory. The attack surface is the network communication between the LXD CLI client and the image server. Because the image server is remote and potentially attacker-controlled (or subject to machine-in-the-middle interception), the vulnerability can be triggered without local access to the client system.

The affected functionality is specifically the "unified image export and copy" operations when the destination is a local directory. The image server's response header is the injection vector. The client's failure to canonicalize or validate the filename before writing to disk enables arbitrary file overwrite.

At the code level, the LXD client likely constructs a destination file path by concatenating the user-specified target directory with the filename provided in the Content-Disposition header. Without proper path normalization and containment checks, sequences like ../../ allow traversal outside the target directory. The exact function or module names are not provided in the available description; the vulnerability class is well understood.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L indicates:

• Attack Vector: Network — exploitable remotely.
• Attack Complexity: High — successful exploitation depends on conditions such as the client connecting to a malicious or compromised image server, or an active machine-in-the-middle position.
• Privileges Required: None.
• User Interaction: Required — the user must initiate an image export or copy operation to a local directory.
• Scope: Unchanged.
• Confidentiality: None — no direct data disclosure.
• Integrity: Low — arbitrary file overwrite is possible, but limited by the need to target specific filenames and paths.
• Availability: Low — overwriting critical files could cause service disruption.

The EPSS score is not yet available, and no public proof-of-concept or exploit code has been observed. CISA KEV status is negative. Patch confidence is 0/4, indicating no patch evidence from tracked sources, but the affected version ranges and fixed versions are specified in the NVD description.

Exploitation Scenarios

The attack chain for CVE-2026-86334 is inferred from the vulnerability class (path traversal via HTTP header) and the NVD description. No public PoC is available.

1. Reconnaissance/target identification: An attacker identifies a target organization or user that utilizes the LXD CLI client for image management. This could be achieved by scanning for exposed LXD API endpoints, monitoring network traffic for LXD image operations, or positioning as a machine-in-the-middle on the network path between the client and legitimate image servers. The attacker may also operate a malicious image server that the victim is enticed to use, or compromise a legitimate image server.

2. Triggering the flaw: The victim initiates a unified image export or copy operation to a local directory using the LXD CLI. The client sends a request to the attacker-controlled or compromised image server. The server responds with an HTTP Content-Disposition header that includes a filename parameter containing path traversal sequences (e.g., ../../.ssh/authorized_keys or ../../etc/cron.d/malicious). Because the client fails to sanitize the filename, it writes the downloaded image data to the traversed path, overwriting an arbitrary file on the client system.

3. Payload/execution method: The payload is the image data itself, which the client writes to the attacker-chosen file path. By overwriting a sensitive file such as an SSH authorized_keys file, a cron job, a shell profile script, or a systemd unit file, the attacker can achieve code execution on the client system upon the next login, scheduled task run, or service restart. The exact execution method depends on which file is overwritten and the system's configuration.

4. Post-exploitation impact: Successful exploitation results in arbitrary file overwrite and potential code execution with the privileges of the user running the LXD client (or higher if the overwritten file is processed by a privileged process). This could lead to persistent access, lateral movement within the network, data exfiltration, or further compromise of the host system. The integrity and availability impacts are low per the CVSS vector, but the actual impact could be severe depending on the targeted file.

Conditions for success: The attacker must control or intercept the image server communication, and the victim must perform an export or copy operation to a local directory. The attack complexity is rated High due to these prerequisites.

Impact Assessment

The business impact of CVE-2026-86334 includes potential compromise of client systems used by administrators and developers who manage LXD containers. The blast radius depends on the number of users performing image export/copy operations and the sensitivity of the files that can be overwritten. Affected systems are those running the vulnerable LXD CLI client versions: 4.0.2 through 4.0.13, 5.0.0 through 5.0.9, 5.21.0 through 5.21.7, and 6.0 through 6.9 (exact lower bounds for the 5.x and 6.x branches are not specified beyond "before" the fixed versions). All platforms are affected.

The CVSS score of 4.2 (Medium) reflects:

• Network attack vector: exploitable remotely.
• High attack complexity: requires machine-in-the-middle or malicious server.
• No privileges required.
• User interaction required: the victim must initiate the vulnerable operation.
• No confidentiality impact.
• Low integrity impact: arbitrary file overwrite possible but limited in scope (specific files and paths).
• Low availability impact: potential disruption if critical files are overwritten.

Although the CVSS score is moderate, the potential for code execution elevates the risk in environments where LXD clients are used with untrusted or unverified image sources. The lack of a public PoC and the EPSS score being unavailable suggest that exploitation is not yet widespread, but the vulnerability is trivial to exploit once the prerequisites are met.

Detection Guidance

Sigma Rule

title: LXD CLI Path Traversal via Content-Disposition Header
id: 7f8a9b2c-1d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects LXD CLI image export or copy operations that may result in path traversal via crafted Content-Disposition header filename parameter.
author: Threat Intelligence
date: 2026/05/22
logsource:
  category: process_creation
  product: linux
detection:
  selection_lxd:
    Image|endswith: '/lxc'
    CommandLine|contains:
      - 'image export'
      - 'image copy'
      - 'export'
      - 'copy'
  selection_target:
    CommandLine|contains:
      - '../'
      - '..\\'
      - '/etc/'
      - '/root/'
      - '/home/'
  condition: selection_lxd and selection_target
falsepositives:
  - Legitimate administrative use of relative paths in image export commands.
level: medium

YARA Rule

rule CVE_2026_86334_LXD_Path_Traversal
{
    meta:
        description = "Detects path traversal sequences in LXD image export/copy Content-Disposition headers or related artifacts"
        author = "Threat Intelligence"
        date = "2026-05-22"
        reference = "CVE-2026-86334"
        severity = "medium"
    strings:
        $cd_header = "Content-Disposition" ascii nocase
        $filename_param = "filename=" ascii nocase
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "/etc/" ascii
        $traversal4 = "/root/" ascii
        $lxd_ua = "lxc/" ascii nocase
    condition:
        $cd_header and $filename_param and any of ($traversal*) and $lxd_ua
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-86334 LXD CLI Path Traversal Attempt via Content-Disposition"; flow:to_server,established; content:"Content-Disposition"; http_header; content:"filename="; http_header; pcre:"/filename\s*=\s*[\"']?[^\"'\r\n]*\.\.\//i"; reference:cve,2026-86334; classtype:attempted-user; sid:100086334; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "lxc" and
  process.args : ("image export", "image copy", "export", "copy") and
  process.args : ("../", "..\\", "/etc/", "/root/")

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=sysmon
| search (process_name="lxc" OR process_name="lxd") AND (process_args="*image export*" OR process_args="*image copy*")
| search process_args="*../*" OR process_args="*..\\*" OR process_args="*/etc/*" OR process_args="*/root/*"
| table _time, host, user, process_name, process_args, parent_process_name
| sort - _time

Wazuh OSSEC Rule

<group name="lxd,cve-2026-86334,">
  <rule id="100863" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">lxc</field>
    <field name="process.args">image export|image copy</field>
    <field name="process.args">\.\./|\.\.\\|/etc/|/root/</field>
    <description>CVE-2026-86334: LXD CLI path traversal attempt detected in image export/copy operation</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Avoid using the LXD CLI to export or copy images from untrusted or unverified image servers.
   • Verify the integrity and authenticity of image servers before performing export/copy operations.
   • Use network segmentation and TLS inspection to detect and block machine-in-the-middle attacks targeting LXD image traffic.
   • Where possible, perform image export/copy operations only to non-sensitive directories and review the filenames provided by the server.

2. Patch/upgrade steps:

   • Upgrade LXD to version 4.0.14, 5.0.10, 5.21.8, or 6.10 or later, as these versions address the vulnerability according to the NVD description.
   • For systems on the 4.0.x branch, upgrade to 4.0.14 or later.
   • For systems on the 5.0.x branch, upgrade to 5.0.10 or later.
   • For systems on the 5.21.x branch, upgrade to 5.21.8 or later.
   • For systems on the 6.x branch, upgrade to 6.10 or later.
   • Follow Canonical's official upgrade procedures for LXD, including using snap packages or distribution repositories as appropriate.

3. Long-term hardening:

   • Implement strict validation and sanitization of filenames received from remote servers in all client applications.
   • Apply the principle of least privilege to LXD client operations, running them as non-privileged users where possible.
   • Monitor for anomalous file writes to sensitive locations (e.g., /etc/, /root/, user home directories) originating from LXD processes.
   • Conduct regular security assessments of LXD deployments and review CVE advisories from Canonical.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86334
• Canonical LXD Security Advisories: https://ubuntu.com/security/cves
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1195: Supply Chain Compromise: https://attack.mitre.org/techniques/T1195/
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-86334 not listed as of report date)

No known threat actor campaigns or exploit-in-the-wild evidence have been observed for this CVE. EPSS score is not yet available.