Description

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-12T20:17:47.060Z",
  "pubdate": "2026-08-12T20:17:47.060Z",
  "executiveSummary": "A link following vulnerability exists in the LXD container management product that allows a malicious actor to achieve arbitrary file read and write operations on the underlying host system. The vulnerability stems from improper validation during the import or unpacking of image archives, where the software fails to check if the metadata.yaml file is a symbolic link.\nThe impact of this security flaw is severe, as successful exploitation grants the attacker read and write access to sensitive files on the host system, potentially leading to privilege escalation, system compromise, or data leakage. The risk implication is critical for environments where untrusted image archives are processed.\nTo exploit this vulnerability, an attacker must possess the capability to supply a crafted image archive containing a malicious symbolic link targeting arbitrary file paths on the host system. The exploitation process relies on tricking the image processing routines into following the symlink when handling the metadata.yaml file.",
  "technicalDetails": "The vulnerability resides within the image processing and unpacking component of LXD. Specifically, when LXD processes incoming image archives during import or unpacking operations, it fails to perform adequate validation checks on file types within the archive payload.\nThe root cause is the absence of verification regarding whether the expected metadata.yaml file is a regular file or a symbolic link. If an attacker crafts a malicious image archive containing a symbolic link named metadata.yaml that points to sensitive target file paths on the host system, the application follows the link during extraction.\nThe attack flow proceeds as follows: First, the attacker constructs a malicious image archive containing the crafted symbolic link pointing to a designated target file on the host. Second, the attacker initiates an import or unpacking operation of this archive within LXD. Third, the vulnerable unpacking routine processes the archive and dereferences the symbolic link when attempting to read or write the metadata.yaml file. Finally, this improper link following results in arbitrary file read or write operations on the host system depending on the interaction.\nPrivilege and authentication requirements depend on the specific deployment context and how the image import functionality is exposed, but successful exploitation directly impacts the host operating system's file space. The payload behavior involves directing file system operations outside the intended extraction directory via directory traversal and symlink resolution. The post-exploitation impact includes unauthorized modification, overwrite, or disclosure of critical host system files."
}