Security · High impactFan score 42 · Tier B
LXD has argument injection in backup compression algorithm leading to AFW and ACE
The Brief
- GitHub Advisory Database published an advisory on 2026-11-06 for LXD (github.com/canonical/lxd).
- The advisory says improper validation of the user-provided backup compression algorithm causes argument injection into the constructed command line.
- According to the advisory, this leads to arbitrary file write and code execution.
Why it matters
Developers and operators running LXD with backups should check the advisory for affected and fixed versions, since the flaw can lead to code execution.
Who’s affected
- Teams running canonical/lxd
Affects github.com/canonical/lxd. Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary…
Timeline
GitHub Advisory Database publishes LXD argument injection advisory
GitHub Advisory Database
LXD has argument injection in backup compression algorithm leading to AFW and ACE