Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C H H H 9.9 .0072 52.2 —
AFFECTED Product Versions Fixed LXD 4.0.0 – —
TIMELINE Jul 28 Reserved by canonical Aug 24 Published (CNA: canonical) Sep 11 EXPLOIT PUBLISHED — CVE-2026-66897 (Canonical LXD). Public exploit reference added.
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.
| Date | Event | Detail |
|---|---|---|
| July 28, 2026 | Reserved | Reserved by canonical |
| August 24, 2026 | Published | Published (CNA: canonical) |
| September 11, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-66897 (Canonical LXD). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Canonical | LXD | — | 4.0.0 | — |
Authoritative record: CVE-2026-66897 at cve.org
Vendors: canonical
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-66897 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
