Security · High impactFan score 20 · Tier C2 sources
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
The Brief
- GitHub Advisory Database published two advisories on 2026-11-06 for github.com/canonical/lxd.
- A specially crafted image can be used to read or create/write arbitrary files on the host.
- The advisories say this could possibly lead to arbitrary command execution on the host.
Why it matters
Hosts that pull and run third-party LXD images could have files on the host read or overwritten by a malicious image, so exposure depends on whether untrusted images are used.
Who’s affected
- Anyone running LXD that uses third-party or untrusted images
Affects github.com/canonical/lxd. Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For…
Timeline
GitHub Advisory Database published advisory on templates/ symlink file read and write via malicious image
GitHub Advisory Database published advisory on rootfs/ symlink file read and write via malicious image
GitHub Advisory Database
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
GitHub Advisory Database
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Full coverage · 2 sources
- 6h ago ↗
GitHub Advisory Database
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image - 7h ago ↗
GitHub Advisory Database
LXD has arbitrary file read+write on host via templates/ symlink in malicious image