{"id":"CVE-2026-86334","revision":"f4e2b46885d643ac82ad9173abee84b4","records":[{"revision":"f4e2b46885d643ac82ad9173abee84b4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-86334","aliases":[],"title":"CLI Path Traversal via Content-Disposition in LXD Image Export/Copy","description":"Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.","state":0,"publishedAt":"2026-09-28T13:21:15.612+00:00","modifiedAt":"2026-09-28T17:56:11.126+00:00","affected":[{"ecosystem":"Vendor product","name":"LXD","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Canonical\",\n                    \"product\": \"LXD\",\n                    \"platforms\": [\n                        \"Linux\"\n                    ],\n                    \"packageName\": \"LXD\",\n                    \"repo\": \"https://github.com/canonical/lxd\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.2\",\n                            \"lessThan\": \"4.0.14\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.0.0\",\n                            \"lessThan\": \"5.0.10\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.21.0\",\n                            \"lessThan\": \"5.21.8\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.0\",\n                            \"lessThan\": \"6.10\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","score":4.2,"severity":"MEDIUM"}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-g4cm-f533-78hq","https://github.com/canonical/lxd/pull/18977","https://github.com/canonical/lxd/pull/18976","https://github.com/canonical/lxd/pull/18974","https://github.com/canonical/lxd/pull/18975","https://github.com/canonical/lxd/pull/18940"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-86334","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-86334","identifiers":["CVE-2026-86334"]},"retained":false,"historicalAffected":[]}],"coverage":[]}