VulnSocial

CVE-2026-85185

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-28: 109-28
Referenced assets1 URL
By indicator
Full discourse1 post
  • VulnTracker@vuln_tracker

    Three critical LXD flaws (CVE-2026-87799, CVE-2026-85185, CVE-2026-85526, CVSS up to 9.9) let an authenticated user with instance creation rights write or delete files on the host as root. All three abuse migration or btrfs backup import paths. Risk is highest on shared hosts where many users can create instances. No exploitation reported by Canonical. Fixed in 5.21.8, 5.0.10, 4.0.14 and the latest 6.x. Details: http://vulntracker.io/cves/CVE-2026-87799 #LXD #Canonical #CVE #InfoSec

    01021245
    781 followersView on X

Explore more

Back to dashboard