CVE-2026-63294 Root RCE via image backup.yaml symlink

Critical 9.9 Published 12 Aug 2026 Updated 13 Aug 2026

Attackers can execute arbitrary commands with root privileges on the host by exploiting symlink handling in LXD image backups.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-63294?

CVE-2026-63294 is a critical path traversal vulnerability in Canonical LXD, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.

Weakness: CWE-59

Which versions are affected by CVE-2026-63294?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-63294?

No fix has been published for CVE-2026-63294 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-63294 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63294 exists.

Sources

Also known as DEBIAN-CVE-2026-63294, GHSA-fv82-v4fj-mm4m, UBUNTU-CVE-2026-63294.