The flaw is a path traversal error in Canonical’s LXD backup import and restore functionality. LXD fails to validate instance and storage volume names found in a backup tarball’s metadata, allowing an attacker to craft directory traversal sequences that redirect file writes outside the intended restore directory. Because restore operations run with the privileges of the LXD daemon, successful exploitation can overwrite system files or place malicious code, leading to arbitrary file overwrite and remote code execution on the host.

The vulnerability applies to Canonical LXD versions older than 4.0.12, 5.0.4, 5.12.2, and any 6.0 series build before the update. Users running those LXD releases are susceptible; upgrading to any of the specified fixed releases eliminates the risk.

The CVSS score of 9.9 classifies this flaw as critical, and it is not listed in CISA’s KEV catalog. Exploitation requires the attacker to import or restore a malicious backup archive via the LXD API, which usually demands authenticated access to the LXD daemon. Once path traversal succeeds, the attacker can overwrite privileged files or deploy executables, achieving remote code execution. With no EPSS score available, the exact launch window is unclear, but the high severity indicates a significant exploitation potential.