GHSA-JPF8-86F3-WP38: CVE-2026-48752: Arbitrary Host File Read and Write via Templates Symlink in Canonical LXD and Incus

CVE-2026-48752 is a critical vulnerability affecting Canonical LXD and Incus container management systems. This vulnerability, identified as CVE-2026-48752 with a CVSS score of 9.9, allows authenticated users with image import permissions to perform arbitrary host file reads and writes. The flaw exists due to improper link resolution before file access (CWE-59), specifically related to symbolic link traversal in the instance templates directory.

During the image archive unpacking process, the daemon does not reject top-level symbolic links within the templates directory. This oversight enables an attacker to manipulate the instance template API, causing the root daemon to traverse the symlink onto the host filesystem. As a result, an attacker can achieve root-level access, allowing complete control over the host system.

The vulnerability is present in specific versions of LXD and Incus, including LXD 4.0.0, 4.0.11, 5.0.0, 5.0.7, and 5.x Feature Releases, as well as Incus 7.2.0. Affected systems include Canonical LXD, Linux Containers Incus, and various LXD releases. The vulnerability is exploitable via network or local UNIX socket APIs, requiring authenticated access during image import.

The vulnerability's technical details include CVE ID: CVE-2026-48752, CWE: CWE-59 (Improper Link Resolution Before File Access), and a CVSS v3.1 score of 9.9, categorizing it as critical. The attack vector is either network or local UNIX socket API, specifically through authenticated image import. The security impact includes arbitrary host file read and write access as root, potentially leading to container escape.

The vulnerability has a public proof-of-concept available, and the National Vulnerability Database (NVD) provides a CVE record (CVE-2026-48752). Mitigation strategies involve upgrading affected systems to patched releases, restricting API access and UNIX socket group memberships, and monitoring host file integrity for symbolic links named "templates." Implementing these measures helps protect against potential exploitation and unauthorized access to the host system.