# LXD arbitrary file read and write on host via templates symlink

Source: https://junglewise.ai/threats/lxd-has-arbitrary-file-read-write-on-host-via-templates-symlink-in-497edb66  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.9 · Published 2026-11-06

LXD is a container platform that manages virtual machines and containers on Linux. A malicious container image with a specially crafted symbolic link can allow an attacker to read, create, or modify arbitrary files on the host system, potentially leading to unauthorized command execution with root privileges. An attacker can exploit this by importing a crafted image and manipulating templates to access sensitive system directories.

Technologies: [github.com/canonical/lxd (Go)](https://junglewise.ai/threats/technologies/github-com-canonical-lxd). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [LXC](https://junglewise.ai/threats/vendors/lxc).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.9, published 6 November 2026.

**Which products and versions are affected?** github.com/canonical/lxd (Go) < 0.0.0-20260203144152-d1c8ba15d160, SEMVER:introduced=0,fixed=0.0.0-20260203144152-d1c8ba15d160.

**Is there a fix for This vulnerability?** Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260203144152-d1c8ba15d160 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run github.com/canonical/lxd (Go) or LXC LXD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/canonical/lxd (Go): upgrade to 0.0.0-20260203144152-d1c8ba15d160 or later

  ```sh
  go get github.com/canonical/lxd@v0.0.0-20260203144152-d1c8ba15d160
  ```


## Technical details

The vulnerability exists in the tar extraction logic in shared/archive/archive.go, which fails to reject top-level symlinks named "templates" during image unpacking. An attacker can create a malicious image containing a templates symlink pointing to arbitrary host directories (e.g., /etc/cron.d), then use incus commands to read or write files in those locations. This permits both arbitrary file access and command execution if system-critical files are targeted.

## Affected products

- LXC LXD

## Timeline

- 2026-11-06: disclosed

## Related threats

- [LXD restricted project bypass leading to arbitrary command execution](https://junglewise.ai/threats/lxd-has-restricted-project-bypass-leading-to-arbitrary-command-9034cd45)
- [LXD project restriction bypass in custom volume copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-for-custom-volume-copy-across-d414fa7a)
- [LXD project restriction bypass in instance copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-in-instance-copy-across-projects-48d466e0)
- [Incus arbitrary file write via trusted image hash](https://junglewise.ai/threats/lxd-has-arbitrary-file-write-on-client-due-to-trusted-image-hash-072dacee)
- [LXD argument injection in backup compression algorithm](https://junglewise.ai/threats/lxd-has-argument-injection-in-backup-compression-algorithm-leading-to-50a60f2a)