The flaw arises in how LXD processes instance template metadata. When a user provides a path for a file in metadata.yaml, LXD checks the path against a confined root directory but later creates the file with an unconfined path string. This mismatch permits a path traversal attack that lets the attacker write to any file on the host, including those owned by root. The result is that an attacker can overwrite critical system files and achieve code execution with root privileges on the host.

The vulnerability affects Canonical's LXD container hypervisor. Any LXD installation older than the patched releases – LXD 4.0.13, 5.0.9, 5.21.7, and 6.10 – is susceptible. This includes all supported LXD 4.x, 5.x, and 6.x releases prior to those specific patch versions.

The CVSS score is 9.9, classifying this as critical. Since the EPSS score is not available and the vulnerability is not listed in CISA KEV, the public exploitation likelihood may be unknown, but the high severity indicates that any attacker who can edit a container or launch a crafted image can escape confinement. Local users who have container editing rights, or any user who can supply a malformed metadata.yaml, can trigger the vulnerability, leading to host root compromise. Therefore the risk is substantial for systems that expose LXD to untrusted users or run modules that allow arbitrary image creation.