The Morning Dev

Only the news worth knowing

‹
 
C20/100

Vulnerability · high

LXD arbitrary file write on client via trusted image hash

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: LXD and Incus clients fetching images from malicious servers

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

The Brief

  • The GitHub Advisory Database published an advisory on 2026-11-06 for an arbitrary file write in the LXD client.
  • The advisory summary describes the flaw in the Incus client: a malicious image server can return a crafted Incus-Image-Hash header that leads to arbitrary file writes.
  • The sources do not state a fix version, a CVSS score, or a CVE identifier.

Why it matters

Developers who pull images from third-party or untrusted image servers with LXD or Incus clients could have files written on their machines without their knowledge.

The checklist behind the tier

Checklist · 1 of 10 yes
YesHits tech teamsLXD is a container and VM manager that ops and IT teams run and build on.
NoCore infrastructureSingle system-container product, not software nearly every team runs like OpenSSH or glibc.
NoPopular toolLXD is used by a fair number of teams but is not a mainstream developer tool.
NoExploited in the wildGitHub Advisory Database entry reports only the flaw; no observed attacks are mentioned.
NoPublic exploitGitHub Advisory Database entry gives a summary only; no public exploit or PoC is mentioned.
NoRemote, no loginGitHub Advisory Database: exploit needs a malicious image server returning a crafted header, with no credentials stated.
NoFull takeoverGitHub Advisory Database says arbitrary file write; code execution or root access is not stated.
NoSecrets exposedGitHub Advisory Database reports arbitrary file write only; no stolen secrets or data are mentioned.
NoSupply chainGitHub Advisory Database describes a client-side file write flaw; no compromised package or pipeline is mentioned.
NoNo fix yetGitHub Advisory Database excerpt does not state whether a patched version is available.

Timeline

  1. GitHub Advisory Database publishes advisory

  2. GitHub Advisory Database

    LXD has arbitrary file write on client due to trusted image hash

Source

LXD has arbitrary file write on client due to trusted image hash ↗ GitHub Advisory Database · 3h ago

First seen · 1 source · Full story page · How tiers are decided