What is CVE-2026-16033?

CVE-2026-16033 is a high-severity vulnerability in Canonical Lxd, classified under Path Traversal. CVSS score: 8.5/10. Published 2026-08-12.

How severe is CVE-2026-16033?

High severity. CVSS v3 base score is 8.5 out of 10.

Path Traversal in Canonical Lxd

CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from esca…

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.

Affected products

Canonical Lxd — versions 4.0.0, 5.0.0

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security@ubuntu.com (vendor-advisory, vdb-entry)

Frequently asked questions

What is CVE-2026-16033?: CVE-2026-16033 is a high-severity vulnerability in Canonical Lxd, classified under Path Traversal. CVSS score: 8.5/10. Published 2026-08-12.
How severe is CVE-2026-16033?: High severity. CVSS v3 base score is 8.5 out of 10.