Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server

An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2

Authenticated Denial of Service via Malicious Backup Tarball in LXD

Path Traversal in LXD Instance Log File Retrieval

Arbitrary File Read via Template Injection in Snapshot Patterns

LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

LXD client recursive file pull allows directory escape via malicious VM agent

LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths…

LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary…

Project existence disclosure in LXD images API

Project Existence Disclosure via Error Handling in LXD Image Export

SSRF via image import from URL allows internal network probing by authenticated users

Client-Side Path Traversal in LXD-UI

Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`

Authorization Bypass in LXD GET /1.0/certificates Endpoint

CLI Path Traversal via Content-Disposition in LXD Image Export/Copy