A path traversal flaw in LXD enables an attacker to read or create files on the host outside the intended template directory. The vulnerability arises when the system does not sanitize template file paths from malicious image archives, allowing arbitrary file access during the processing of image metadata templates. This could allow read or write access to system files, exposing sensitive data or enabling further compromise. The weakness is classified as CWE‑22.

The issue affects Canonical’s LXD product. Users running LXD versions earlier than 4.0.12 or 5.0.8 are vulnerable. Upgrading to LXD 4.0.12 (or later) or 5.0.8 (or later) eliminates the flaw.

The CVSS score of 8.5 indicates high severity, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the most likely attack vector is a remote attacker supplying a crafted image archive that contains malicious template directives to traverse paths and access host files. Exploitation requires the attacker to upload or provide the vulnerable image to the LXD daemon, which then processes the metadata and writes or reads files on the host.