What is CVE-2026-63294?
This is a link following vulnerability in the LXD container management system. An attacker can achieve root command execution on the host system by exploiting improper validation of a symlinked backup.yaml file during the import of crafted image or backup archives. Immediate update to the latest LXD version is strongly recommended.
Azərbaycanca: Bu, LXD konteyner idarəetmə sistemində 'link following' zəifliyidir. Təcavüzkar xüsusi hazırlanmış image və ya backup arxivini idxal edərkən 'backup.yaml' simvolik linkini manipulyasiya edərək host sistemdə root səlahiyyətləri ilə ixtiyari əmr icrasına nail ola bilər. Dərhal LXD-ni ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
What is the nature of the CVE-2026-63294 vulnerability that allows gaining root privileges on the host system in LXD?
This is a link following vulnerability in the LXD container management system. An attacker can achieve root command execution on the host system by exploiting improper validation of a symlinked backup.yaml file during the import of crafted image or backup archives.
What action should be taken to protect against the CVE-2026-63294 vulnerability?
Immediate update to the latest LXD version is strongly recommended.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.