{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-85185",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-85185",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-28T13:21:51.596Z",
    "updatedAt": "2026-09-28T16:32:28.529Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root",
      "summary": "Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.",
      "affected": [
        {
          "vendor": "Canonical",
          "product": "LXD",
          "packageName": "LXD",
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4.0.2",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.0.14"
            },
            {
              "version": "5.0.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.0.10"
            },
            {
              "version": "5.21.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.21.8"
            },
            {
              "version": "6.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.10"
            }
          ]
        }
      ]
    }
  }
}