A critical path traversal vulnerability in Canonical LXD allows authenticated attackers to bypass directory restrictions during backup restoration, posing a severe risk of host system compromise.

This is a path traversal flaw (CWE-22) occurring during backup import or restore operations. The application fails to validate instance and storage volume names within archive metadata, allowing an authenticated attacker to access or overwrite files outside the intended restore directory.

Successful exploitation allows an attacker to read sensitive configuration files or overwrite critical system binaries on the host. Given the CVSS score of 9.9, this vulnerability represents a critical risk of full container escape and host takeover, potentially leading to total loss of confidentiality, integrity, and availability of the host environment.

Immediate Action: Upgrade to LXD version 4.0.12, 5.0.4, 5.12.2, or 6.0.1 (or later) immediately as recommended by the vendor.

Proactive Monitoring: Review system logs for unusual backup import patterns or unexpected file access events originating from the LXD service.

Compensating Controls: Restrict the ability to import or restore backup archives to only trusted administrative users to minimize the attack surface.

Public Exploit Available: No

The severity of this vulnerability necessitates an immediate patching cycle. Administrators should prioritize upgrading all instances of Canonical LXD to the fixed versions listed above to prevent potential host-level exploitation.