# CVE-2026-16033: LXD path traversal in QEMU template processing

Source: https://junglewise.ai/threats/cve-2026-16033-lxd-path-traversal-in-qemu-template-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16033 · Severity: high · CVSS 8.5 · Published 2026-08-12

LXD is a container and virtual machine management system. A path traversal flaw in the QEMU/VM driver allows authenticated users who can create or restore VMs to read arbitrary files from the host (including sensitive files like /etc/shadow) and create root-owned files anywhere on the host filesystem. This could lead to exposure of confidential system data or privilege escalation.

Technologies: [Canonical LXD](https://junglewise.ai/threats/technologies/lxd). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-16033 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16033 being exploited in the wild.

**How severe is CVE-2026-16033?** High severity, with a CVSS score of 8.5, published 12 August 2026.

**Which products and versions are affected?** Canonical LXD 4.0.0 through 5.0.7.

**Is there a fix for CVE-2026-16033?** A patch was published on 2026-07-31: Fixed in LXD 4.0.12 and 5.0.7+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16033 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16033?** Check whether you run Canonical LXD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in LXD's QEMU/VM driver template processing (driver_qemu.go, templateApplyNow function). Unlike the LXC container driver which was patched for CVE-2026-48752 with proper path validation, the QEMU driver lacks safeguards when processing template file paths from image metadata. An authenticated attacker who can create or launch a VM from a custom image or restore a VM backup can craft malicious metadata.yaml containing path traversal sequences (e.g., "../../../../etc/shadow") to read arbitrary host files or write root-owned files with a .out suffix. The vulnerability requires authentication and the ability to provide a custom image, but no user interaction is needed once the VM is launched. Patches are available in versions 4.0.12 and 5.0.7 and later.

## Affected products

- Canonical LXD 4.0.0 through 5.0.7

## Timeline

- 2026-07-31: disclosed
- 2026-08-12: advisory
- 2026-07-31: patched: Fixed in LXD 4.0.12 and 5.0.7+

## References

- [https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh](https://github.com/canonical/lxd/security/advisories/GHSA-9hcm-hxh5-7xxh)

## Related threats

- [LXD project restriction bypass in instance copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-in-instance-copy-across-projects-48d466e0)
- [Canonical LXD improper certificate validation in HTTPS listener](https://junglewise.ai/threats/cve-2026-112816-improper-certificate-validation-in-the-https-listener-in)
- [Canonical LXD custom storage volume authorization bypass](https://junglewise.ai/threats/cve-2026-97335-incorrect-authorization-in-the-custom-storage-volume-creation)
- [Canonical LXD arbitrary file write via symlink in migration stream](https://junglewise.ai/threats/cve-2026-87799-improper-link-resolution-in-the-migration-receive-path-in)
- [Canonical LXD improper symlink resolution in recursive file pull](https://junglewise.ai/threats/cve-2026-87798-improper-link-resolution-in-the-recursive-file-pull-feature-of)