A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m Third Party Advisory, Exploit, Mitigation
- https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m Third Party Advisory, Exploit, Mitigation
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.9 · canonicalNVD modified 2026-10-23 19:10
Affected (CPE criteria) 1
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*
References 2
- https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m Third Party Advisory, Exploit, Mitigation
- https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m Third Party Advisory, Exploit, Mitigation