CVE-2026-63293

critical · 9.9

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.

9.9

CVSS

0.6%

EPSS (exploit prob.)

46th

EPSS percentile

2026-08-12

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-59

Affected products

Vendor	Product	Affected versions
canonical	lxd	>= 4.0.0, < 4.0.12

Check a specific version with /api/v1/cve/match.

References

https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5
https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-63293