Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

LXD Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Published	Severity

`CVE-2026-66897`Instance template path traversal allows arbitrary host file write as root	Exploitation statusNot known exploited	FixYes	Published08/24/2026	SeverityCritical
`CVE-2026-16033`Arbitrary file read+write on host via templates/ symlink in malicious image	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityHigh
`CVE-2026-66898`Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityCritical
`CVE-2026-63293`Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityCritical
`CVE-2026-63294`Root RCE via image backup.yaml symlink	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityCritical
`CVE-2026-63295`Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityMedium
`CVE-2026-63296`Project restriction bypass via instance migration config override	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityCritical
`CVE-2026-63297`Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityCritical
`CVE-2026-63298`LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityHigh
`CVE-2026-63299`Storage volume cross-project move and snapshot restore bypass project disk limits	Exploitation statusNot known exploited	FixYes	Published08/12/2026	SeverityHigh
`CVE-2026-62420`Cross-project cluster migration bypasses project restrictions via cluster notification flag	Exploitation statusNot known exploited	FixYes	Published08/12/2026	SeverityCritical
`CVE-2026-63300`Cross-project instance move bypasses all project restrictions allowing host command execution	Exploitation statusPublic exploit	FixYes	Published08/12/2026	SeverityCritical
`CVE-2026-28385`SSRF via image import from URL allows internal network probing by authenticated users	Exploitation statusNot known exploited	FixYes	Published06/26/2026	SeverityMedium
`CVE-2026-9640`LXD Snapshot Import Privilege Escalation Vulnerability	Exploitation statusPublic exploit	FixYes	Published06/26/2026	SeverityHigh
`CVE-2026-9639`Authenticated Denial of Service via Malicious Backup Tarball in LXD	Exploitation statusPublic exploit	FixYes	Published06/26/2026	SeverityMedium
`CVE-2026-12411`Broken Access Control in Canonical LXD DevLXD API	Exploitation statusPublic exploit	FixYes	Published06/26/2026	SeverityHigh
`CVE-2026-34179`Update of type field in restricted TLS certificate allows privilege escalation to cluster admin	Exploitation statusPublic exploit	FixYes	Published04/09/2026	SeverityCritical
`CVE-2026-34178`Importing a crafted backup leads to project restriction bypass	Exploitation statusPublic exploit	FixYes	Published04/09/2026	SeverityCritical
`CVE-2026-34177`VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf	Exploitation statusPublic exploit	FixYes	Published04/09/2026	SeverityCritical
`CVE-2026-28384`Authenticated RCE via unsanitized compression_algorithm	Exploitation statusPublic exploit	FixYes	Published03/12/2026	SeverityCritical
`CVE-2026-3351`Authorization Bypass in LXD GET /1.0/certificates Endpoint	Exploitation statusNot known exploited	FixYes	Published03/03/2026	SeverityLow
`CVE-2025-54293`Path Traversal in LXD Instance Log File Retrieval	Exploitation statusPublic exploit	FixYes	Published10/02/2025	SeverityHigh
`CVE-2025-54292`Client-Side Path Traversal in LXD-UI	Exploitation statusPublic exploit	FixYes	Published10/02/2025	SeverityMedium
`CVE-2025-54291`Project existence disclosure in LXD images API	Exploitation statusPublic exploit	FixYes	Published10/02/2025	SeverityMedium
`CVE-2025-54290`Project Existence Disclosure via Error Handling in LXD Image Export	Exploitation statusPublic exploit	FixYes	Published10/02/2025	SeverityMedium
`CVE-2025-54289`Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API	Exploitation statusNot known exploited	FixYes	Published10/02/2025	SeverityHigh
`CVE-2025-54288`Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server	Exploitation statusPublic exploit	FixYes	Published10/02/2025	SeverityMedium
`CVE-2025-54287`Arbitrary File Read via Template Injection in Snapshot Patterns	Exploitation statusPublic exploit	FixYes	Published10/02/2025	SeverityHigh
`CVE-2025-54286`CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI	Exploitation statusNot known exploited	FixYes	Published10/02/2025	SeverityHigh
`CVE-2024-6219`	Exploitation statusPublic exploit	FixYes	Published12/05/2024	SeverityLow
`CVE-2024-6156`	Exploitation statusPublic exploit	FixYes	Published12/05/2024	SeverityLow
`CVE-2023-49721`	Exploitation statusNot known exploited	FixNot confirmed	Published02/14/2024	SeverityMedium
`CVE-2023-48733`	Exploitation statusPublic exploit	FixYes	Published02/14/2024	SeverityMedium
`CVE-2016-1581`	Exploitation statusNot confirmed	FixNot confirmed	Published06/09/2016	SeverityUnknown
`CVE-2016-1582`	Exploitation statusNot confirmed	FixNot confirmed	Published06/09/2016	SeverityUnknown

35 / 35 Results

All vulnerabilities loaded

Security vulnerabilities in LXD

LXD

How many security vulnerabilities does LXD currently have?

Does the latest version of LXD have any known vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management