# CVE-2026-85526

Path traversal in LXD btrfs driver allows host file deletion/overwrite as root.

- Page: https://www.vulneraibility.com/cve/CVE-2026-85526
- CVSS: 9.9
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.53% (percentile 45.2)
- CISA SSVC: exploitation poc, automatable no, technical impact total (assessed 2026-09-28)
- Weakness: CWE-22
- Also known as: GHSA-h85r-gjgx-g2rv
- Published: 2026-09-28

## Affected versions

- Canonical LXD: affected >= 4.0.0 and < 4.0.14; >= 5.0.0 and < 5.0.10; >= 5.21.0 and < 5.21.8; >= 6.0 and < 6.10

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated user with instance-creation rights can delete or replace arbitrary host files as root via crafted btrfs backup import, enabling host takeover and data loss.

## Action

Immediate action required

## Recommendation

Apply vendor LXD update immediately; restrict/revoke instance-creation privileges.

## References

- [advisory] https://github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rv
- [patch] https://github.com/canonical/lxd-private/pull/87
- [patch] https://github.com/canonical/lxd-private/pull/105
- [patch] https://github.com/canonical/lxd-private/pull/104
- [patch] https://github.com/canonical/lxd-private/pull/103
- [patch] https://github.com/canonical/lxd-private/pull/84

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.