CVE-2026-16033

Name of the Vulnerable Software and Affected Versions LXD (affected versions not specified)

Description A path traversal flaw exists when processing image metadata templates, specifically affecting virtual machine and QEMU driver execution paths. The system fails to properly sanitize or restrict template file paths, allowing them to escape the instance templates directory. An attacker can exploit this by providing a crafted image archive containing malicious template directives with path traversal sequences, enabling arbitrary host file read or unconstrained file creation outside the intended directory on the host system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.