CVE-2026-63293

Awaiting Analysis Awaiting Analysis - Queue

LXD Link Following Arbitrary File Read Write

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: Canonical Ltd.

Description

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-63293

EUVD

EUVD-2026-57540

Affected Vendors & Products

Vendor	Product	Version / Range
canonical	lxd	From 4.0 (inc)
canonical	lxd	4.0.12
canonical	lxd	5.0.8
canonical	lxd	5.21.6
canonical	lxd	6.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

CVE-2026-63293 is a critical link following vulnerability in LXD that allows attackers to read or write arbitrary files on the host system as root. It occurs when importing an image archive with a symlinked metadata.yaml file pointing to target file paths. The vulnerability affects Incus versions 4.0 and later.

Detection Guidance

To detect this vulnerability, check the version of LXD/LXC (Incus) installed on your system. Run: lxd --version or incus --version. If your version is below 4.0.12, 5.0.8, 5.21.6, or 6.10, the system is vulnerable. Additionally, review logs for unusual file operations or symlink creation during image imports.

Impact Analysis

This vulnerability can lead to full system compromise. Attackers can create backdoors, modify configuration files, or corrupt critical system files. It does not require privileged containers or kernel exploits, making it accessible to any authenticated Incus user.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. An attacker could read or modify files containing personal data, health records, or other regulated information, leading to violations of confidentiality and integrity requirements. The ability to overwrite system files may also compromise audit logs or security controls, further undermining compliance efforts.

Mitigation Strategies

Immediately update LXD/LXC (Incus) to a patched version: 4.0.12, 5.0.8, 5.21.6, or 6.10 or later. Restrict access to authenticated users only and avoid importing untrusted image archives. Monitor for suspicious file modifications or symlink activities.

Hi! I’m here to help you understand CVE-2026-63293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70