The Morning Dev

Only the news worth knowing

‹
 
C20/100

Vulnerability · high

LXD host file write via exec-output symlink in crafted image

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: LXD hosts running crafted or untrusted instance images

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

The Brief

  • GitHub Advisory Database published an advisory for an LXD vulnerability on 2026-11-06.
  • The flaw allows arbitrary file writes on the host via an exec-output symlink in a crafted image.
  • The record-output parameter of the /instances/$name/exec endpoint stores command output in the instance's exec-output directory.

Why it matters

Hosts running LXD with untrusted or crafted images could have files written outside the intended directory on the host, which can lead to host compromise.

The checklist behind the tier

Checklist · 1 of 10 yes
YesHits tech teamsLXD is a container and VM manager that ops teams run on servers, so it counts.
NoCore infrastructureLXD is a single product, not software nearly every team runs like OpenSSH or the Linux kernel.
NoPopular toolLXD is used by some Linux operators but is niche compared with mainstream developer tools.
NoExploited in the wildGitHub Advisory Database: advisory describes the flaw only; no source reports observed attacks.
NoPublic exploitGitHub Advisory Database: advisory summary gives no published exploit or proof-of-concept.
NoRemote, no loginGitHub Advisory Database: exploitation requires a crafted image, and no source says it is remote without credentials.
NoFull takeoverGitHub Advisory Database: reports arbitrary host file write, but no source states code execution or root.
NoSecrets exposedGitHub Advisory Database: no source reports stolen credentials, keys, configs or data.
NoSupply chainGitHub Advisory Database: a crafted image is a vulnerability trigger, and no source reports a compromised channel.
NoNo fix yetGitHub Advisory Database: no source states whether a patched version is available.

Timeline

  1. GitHub Advisory Database publishes the LXD advisory

  2. GitHub Advisory Database

    LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Source

LXD has arbitrary file write on host via `exec-output` symlink in crafted image ↗ GitHub Advisory Database · 7h ago

First seen · 1 source · Full story page · How tiers are decided