{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"lxd","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NVZF6PKYVG5KVFSK23T1BT","modified_at":"2026-10-04T00:00:13.575750216Z","published_at":"2026-09-28T14:17:20.130Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-85185","https://security-tracker.debian.org/tracker/CVE-2026-85185"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-85185#Debian:13/lxd","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-85185"}],"summary":"Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instan"}