Description

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-28T14:17:20.130Z",
  "pubdate": "2026-09-28T14:17:20.130Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the btrfs storage driver of Canonical LXD, identified in versions 4.0.2 and later. This flaw allows an authenticated client, holding permissions to create instances within a project, to bypass filesystem constraints and interact with arbitrary files on the host system with root-level privileges.\nThe vulnerability is triggered by improperly sanitized subvolume paths containing directory traversal sequences ('../') passed during specific btrfs operations. Attackers can leverage these sequences via crafted 'optimized_header.yaml' files in backups or malicious btrfs migration headers. On hosts where the root filesystem utilizes btrfs, this vulnerability escalates to full host compromise, as an attacker can write malicious content to arbitrary host paths. Successful exploitation requires an authenticated attacker with project-level instance creation permissions, posing a significant risk to multi-tenant environments where internal project isolation is expected to prevent host-level interference.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation and sanitization of subvolume paths processed by the LXD btrfs storage driver. When the driver handles subvolume-related operations, it fails to normalize or restrict paths provided by user-controlled inputs, specifically within the migration and backup restoration workflows. This failure allows the injection of path traversal sequences ('../'), which the storage driver subsequently interprets relative to the host filesystem root rather than the intended project-scoped directory.\nThe attack flow proceeds through two primary vectors: manipulated optimized btrfs backups and malicious migration sources. In the first scenario, an attacker crafts an 'optimized_header.yaml' file as part of an optimized btrfs backup. Upon ingestion by the LXD daemon, the driver parses the path strings without adequate sanitization, resulting in the application of subvolume operations on sensitive host files. In the second scenario, a malicious migration source sends a crafted btrfs migration header containing the traversal payload to the target LXD host. The receiving LXD instance processes this header during the migration handshake, permitting the attacker to escape the designated storage volume.\nThe vulnerable component is the LXD btrfs storage driver responsible for volume orchestration and migration. Because these operations are executed with root privileges by the LXD daemon, any traversal enables the deletion of arbitrary host files. Furthermore, if the host root partition is formatted with btrfs, the exploit allows for the creation and overwriting of files on the host. An attacker can write malicious binaries, modify system configuration files, or inject unauthorized SSH keys, leading to full system compromise. The vulnerability is present in versions 4.0.2 through 4.0.13, 5.0.x before 5.0.10, 5.x before 5.21.8, and 6.x before 6.10. Exploitation requires authenticated access to the LXD API with project-level instance creation rights, but it does not require prior root access on the host."
}