CVE-2026-85526

CriticalCVSS 9.9/10Last modified Sep 29, 2026

Description

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Canonical	LXD	>= 4.0.0, < 4.0.14; >= 5.0.0, < 5.0.10; >= 5.21.0, < 5.21.8; >= 6.0, < 6.10

References

Timeline

Published: Sep 28, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-855285.3Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a crede CVE-2026-855295.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-85533.1Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform CVE-2026-855308.1The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the va CVE-2026-855319.8Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Modu CVE-2026-855327.5Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak CVE-2026-855337.6An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to u CVE-2026-855345.9A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data t CVE-2026-855388.3An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required p CVE-2026-85543.1Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce CVE-2026-855408.8DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to rea CVE-2026-855415.4DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary J