Quick answers
- Is CVE-2026-85185 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85185 being exploited in the wild.
- How severe is CVE-2026-85185?
- Critical severity, with a CVSS score of 9.6, published 28 September 2026.
- Which products and versions are affected?
- Canonical LXD 4.0.2 through 4.0.13, 5.0.0 through 5.0.9, 5.1 through 5.21.7, 6.0 through 6.9.
- Is there a fix for CVE-2026-85185?
- A patch was published on 2026-09-28: Fixed in versions 4.0.14, 5.0.10, 5.21.8, and 6.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-85185 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-85185?
- Check whether you run Canonical LXD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the btrfs storage driver where the BTRFSSubVolume.Path field from backup headers or migration wire data is passed directly to filepath.Join() and root-level filesystem operations without validation or path containment checks. An authenticated project-restricted user can craft a subvolume path containing ../ sequences to escape the storage pool, enabling arbitrary file deletion via os.Remove() and arbitrary file placement via os.Rename() on btrfs-root systems, leading to root code execution.
Affected products
- Canonical LXD 4.0.2 through 4.0.13, 5.0.0 through 5.0.9, 5.1 through 5.21.7, 6.0 through 6.9
Timeline
- 2026-09-25: disclosed
- 2026-09-25: advisory
- 2026-09-28: patched: Fixed in versions 4.0.14, 5.0.10, 5.21.8, and 6.10