Security · High impactFan score 20 · Tier C
LXD has arbitrary file write on host via `exec-output` symlink in crafted image
The Brief
- GitHub Advisory Database published an advisory for an LXD vulnerability on 2026-11-06.
- The flaw allows arbitrary file writes on the host via an exec-output symlink in a crafted image.
- The record-output parameter of the /instances/$name/exec endpoint stores command output in the instance's exec-output directory.
Why it matters
Hosts running LXD with untrusted or crafted images could have files written outside the intended directory on the host, which can lead to host compromise.
Who’s affected
- LXD users running instances from untrusted or third-party images
- #lxd
- #security
- #vulnerability
- #containers
- #file-write
Affects github.com/canonical/lxd. Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If…
Timeline
GitHub Advisory Database publishes the LXD advisory
GitHub Advisory Database
LXD has arbitrary file write on host via `exec-output` symlink in crafted image