GHSA-JPF8-86F3-WP38: CVE-2026-48752: Arbitrary Host File Read and Write via Templates Symlink in Canonical LXD and Incus

During image archive unpacking, the daemon fails to reject top-level symbolic links for the instance templates directory. Subsequent requests to the instance template API endpoints follow this symbolic link outside the instance storage directory with root privileges, enabling complete host compromise. TL;DR Authenticated users capable of importing images into LXD or Incus can include a symbolic link at the templates path inside an image tarball.

Interacting with the instance template management API causes the root daemon to traverse this symlink onto the host filesystem, granting arbitrary file read and write access as root. ⚠️ Exploit Status: POC Technical Details CVE ID: CVE-2026-48752 Primary CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following') CVSS v3.1 Score: 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Attack Vector: Network / Local UNIX Socket API (Authenticated Image Import) Security Impact: Arbitrary Host File Read & Write as Root / Container Escape EPSS Score: 0.78% (56.22nd Percentile) Exploit Status: Public Proof-of-Concept Available CISA KEV Status: Not Listed Affected Systems Canonical LXD Linux Containers Incus LXD (4.0 LTS): >= 4.0.0, < 4.0.11 (Fixed in: 4.0.11) LXD (5.0 LTS): >= 5.0.0, < 5.0.7 (Fixed in: 5.0.7) LXD (5.x Feature Releases): >= 5.1.0, < 5.21.5 (Fixed in: 5.21.5) LXD (6.x): >= 6.0.0, < 6.9.0 (Fixed in: 6.9.0) Incus: < 7.2.0 (Fixed in: 7.2.0) Code Analysis Commit: 190e245 lxd/instance/drivers/common: Prevent rootfs or templates dir to be a symlink diff --git a/lxd/instance/drivers/driver_common.go b/lxd/instance/drivers/driver_common.go index 8bd1c424d81d..eb33a73d2619 100644 --- a/lxd/instance/drivers/driver_common.go +++ b/lxd/instance/drivers/driver_common.go @@ -3,6 +3,7 @@ package drivers import ( "database/sql" "fmt" + "os" "path/filepath" "strconv" "strings" @@ -321,8 +322,9 @@ func (d *common) Path() string { } -func (d *common) RootfsPath() string { - return filepath. Join(d. Path(), "rootfs") +// Returns an error if the path exists and is a symlink. +func (d *common) RootfsPath() (string, error) { + return d.subPath("rootfs") @@ -337,8 +339,29 @@ func (d *common) StatePath() string { -func (d *common) TemplatesPath() string { - return filepath.

Join(d. Path(), "templates") +func (d *common) TemplatesPath() (string, error) { + return d.subPath("templates") +} + +// subPath returns the path of name beneath the instance's path, rejecting it if it exists and is a symlink. +func (d *common) subPath(name string) (string, error) { + path := filepath. Join(d.

Path(), name) + fi, err := os. Lstat(path) + if err != nil { + if os. IsNotExist(err) { + return path, nil + } + return "", err + if fi.

Mode()&os. ModeSymlink != 0 { + return "", fmt. Errorf("%q for instance %q is a symlink", name, d.name) Commit: 254b85c lxd/instance_metadata: Confine opening of templates Commit: 4cd6334 Commit: 734fcc4 Commit: 79f3879 Commit: cbefa31 incusd/instance: Confine template access to instance root (addresses CVE-2026-48752) Exploit Details GitHub Security Advisory (Canonical LXD): Official vendor advisory containing the shell script proof-of-concept demonstrating arbitrary host file read and write via /etc/cron.d.

GitHub Security Advisory (Linux Containers Incus): Incus security advisory detailing the templates symlink vulnerability and proof-of-concept reproduction steps. Mitigation Strategies Upgrade Canonical LXD or Linux Containers Incus to a patched release that enforces directory confinement using os. OpenRoot.

Restrict API access, local UNIX socket group memberships (lxd/incus-admin), and TLS client certificate trust stores to trusted system administrators. Audit host storage pool directories for existing instances containing symbolic links named 'templates'. Monitor host file integrity in sensitive directories such as /etc/cron.d, /etc/systemd/system, and /root/.ssh.

Remediation Steps: For Linux Containers Incus, upgrade the incus package to version 7.2.0 or later using your distribution package manager. For Canonical LXD, refresh the snap package or upgrade to version 4.0.11, 5.0.7, 5.21.5, or 6.9.0+ depending on the active release channel. Execute find /var/snap/lxd/common/lxd/storage-pools/ -maxdepth 4 -name templates -type l (LXD) or find /var/lib/incus/storage-pools/ -maxdepth 4 -name templates -type l (Incus) to identify any maliciously crafted instances.

Review daemon access logs for anomalous GET or POST requests to /1.0/instances//metadata/templates. References GitHub Security Advisory (Canonical LXD): GHSA-jpf8-86f3-wp38 GitHub Security Advisory (Linux Containers Incus): GHSA-vxp5-584q-c479 National Vulnerability Database (NVD): CVE-2026-48752 CVE.org Record: CVE-2026-48752 Incus 7.2 Release Announcement & Security Advisories Linux Containers Discussion Forum: Incus 7.2 Release Incus Patch Commit: cbefa31ae0da8fd96361178aed3a3c631e098fef LXD Patch Commit: 190e2451544a60f6f924ef50a2112fb65d1923cd LXD Patch Commit: 254b85c9301397e25304116b63da9154093199da Read the full report for GHSA-JPF8-86F3-WP38 on our website for more details including interactive diagrams and full exploit analysis.