Security · High impactFan score 20 · Tier C2 sources
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
The Brief
- GitHub Advisory Database published an advisory on 2026-11-06 for github.com/canonical/lxd.
- A specially crafted image can use a templates/ symlink to read or create/write arbitrary files on the host.
- The advisory says this could possibly lead to arbitrary command execution on the host.
Why it matters
Anyone who runs LXD and imports images from outside sources could have files on the host read or written by a malicious image.
Who’s affected
- LXD users who run images from untrusted sources
- #lxd
- #security
- #vulnerability
- #containers
- #file-access
Affects github.com/canonical/lxd. Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus…
Timeline
Full coverage · 2 sources
- 2h ago ↗
GitHub Advisory Database
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
- 3h ago ↗
GitHub Advisory Database
LXD has arbitrary file read+write on host via templates/ symlink in malicious image