CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE

Critical 9.9 Published 12 Aug 2026 Updated 13 Aug 2026

Attackers can achieve root file write and remote code execution by crafting malicious backup archives with path traversal sequences in LXD.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-66898?

CVE-2026-66898 is a critical path traversal vulnerability in Canonical LXD, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.

Weakness: CWE-22

Which versions are affected by CVE-2026-66898?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-66898?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-66898 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66898 exists.

Sources

Also known as DEBIAN-CVE-2026-66898, GHSA-m857-c7gc-c984, UBUNTU-CVE-2026-66898.