A critical path traversal vulnerability in Canonical LXD allows authenticated users with container permissions to escalate privileges to host root, posing a severe risk of full system compromise.

The vulnerability arises due to a discrepancy in how LXD processes template paths. While the software validates paths against a confined root directory, it subsequently uses unconfined string paths for file creation, allowing an authenticated attacker to perform path traversal and overwrite sensitive files on the host.

The ability to overwrite host-level files as root leads to a total compromise of the host system. With a CVSS score of 9.9, this vulnerability represents an extreme threat to infrastructure integrity, as it allows attackers to break out of containerized environments and gain persistent control over the underlying server.

Immediate Action: Upgrade LXD to versions 4.0.13, 5.0.9, 5.21.7, 6.10, or later immediately.

Proactive Monitoring: Audit container metadata configurations and monitor for unauthorized attempts to modify sensitive host system files or configuration directories.

Compensating Controls: Restrict the ability of untrusted users to launch or edit container images and templates until the patch is applied.

Public Exploit Available: No (exploit_available: false).

Given the potential for complete host system takeover, this vulnerability must be treated as a high-priority incident. Administrators should verify their LXD versions and apply the provided security updates across all production clusters without delay.