{
  "id": 18553656,
  "title": "GHSA-JPF8-86F3-WP38: CVE-2026-48752: Arbitrary Host File Read and Write via Templates Symlink in Canonical LXD and Incus",
  "url": "https://urgent.news/2026/11/06/ghsa-jpf8-86f3-wp38-cve-2026-48752-arbitrary-host-file-read-and-write",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T19:30:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/ghsa-jpf8-86f3-wp38-cve-2026-48752-arbitrary-host-file-read-and-write-via-templates-symlink-in-24oc"
  },
  "original_language": "en",
  "account": "CVE-2026-48752 is a critical vulnerability affecting Canonical LXD and Incus container management systems. This vulnerability, identified as CVE-2026-48752 with a CVSS score of 9.9, allows authenticated users with image import permissions to perform arbitrary host file reads and writes. The flaw exists due to improper link resolution before file access (CWE-59), specifically related to symbolic link traversal in the instance templates directory.\n\nDuring the image archive unpacking process, the daemon does not reject top-level symbolic links within the templates directory. This oversight enables an attacker to manipulate the instance template API, causing the root daemon to traverse the symlink onto the host filesystem. As a result, an attacker can achieve root-level access, allowing complete control over the host system.\n\nThe vulnerability is present in specific versions of LXD and Incus, including LXD 4.0.0, 4.0.11, 5.0.0, 5.0.7, and 5.x Feature Releases, as well as Incus 7.2.0. Affected systems include Canonical LXD, Linux Containers Incus, and various LXD releases. The vulnerability is exploitable via network or local UNIX socket APIs, requiring authenticated access during image import.\n\nThe vulnerability's technical details include CVE ID: CVE-2026-48752, CWE: CWE-59 (Improper Link Resolution Before File Access), and a CVSS v3.1 score of 9.9, categorizing it as critical. The attack vector is either network or local UNIX socket API, specifically through authenticated image import. The security impact includes arbitrary host file read and write access as root, potentially leading to container escape.\n\nThe vulnerability has a public proof-of-concept available, and the National Vulnerability Database (NVD) provides a CVE record (CVE-2026-48752). Mitigation strategies involve upgrading affected systems to patched releases, restricting API access and UNIX socket group memberships, and monitoring host file integrity for symbolic links named \"templates.\" Implementing these measures helps protect against potential exploitation and unauthorized access to the host system.",
  "summary": "CVE-2026-48752: Arbitrary Host File Read and Write via Templates Symlink in Canonical LXD and Incus Vulnerability ID: GHSA-JPF8-86F3-WP38 CVSS Score: 9.9 Published: 2026-11-06 A symbolic link traversal vulnerability (CWE-59) in Canonical LXD and Linux Containers Incus allows an authenticated user with image import permissions to read and write arbitrary files on the host filesystem. During image…",
  "key_points": [
    "CVE-2026-48752 critical vulnerability in LXD and Incus container management systems.",
    "Authenticated users with image import permissions can read/write arbitrary host files.",
    "Flaw due to improper link resolution in instance templates directory."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}