Security · High impactFan score 20 · Tier C
LXD has arbitrary file write on client due to trusted image hash
The Brief
- The GitHub Advisory Database published an advisory on 2026-11-06 for an arbitrary file write in the LXD client.
- The advisory summary describes the flaw in the Incus client: a malicious image server can return a crafted Incus-Image-Hash header that leads to arbitrary file writes.
- The sources do not state a fix version, a CVSS score, or a CVE identifier.
Why it matters
Developers who pull images from third-party or untrusted image servers with LXD or Incus clients could have files written on their machines without their knowledge.
Who’s affected
- LXD users pulling images from untrusted servers
- Incus client users pulling images from untrusted servers
- #lxd
- #incus
- #vulnerability
- #containers
- #image-trust
Affects github.com/canonical/lxd. Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary…
Timeline
GitHub Advisory Database publishes advisory
GitHub Advisory Database
LXD has arbitrary file write on client due to trusted image hash