CVE-2026-16033: Arbitrary file read+write on host via templates/ symlink in malicious image
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LXDto a version that resolves this vulnerability.Fixed in 4.0.12 - Upgrade
Upgrade
LXDto a version that resolves this vulnerability.Fixed in 5.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16033?
The severity of CVE-2026-16033 is high with a score of 8.5.
What is CVE-2026-16033?
CVE-2026-16033 is a path traversal vulnerability in LXD that allows arbitrary file read or write on the host via malicious image templates.
How do I fix CVE-2026-16033?
To fix CVE-2026-16033, ensure you are using the latest version of LXD that addresses this vulnerability.
What can an attacker do with CVE-2026-16033?
An attacker can exploit CVE-2026-16033 to read arbitrary files from the host or create files outside of the intended directory.
Which software is affected by CVE-2026-16033?
The vulnerability CVE-2026-16033 affects the LXD software.