A critical link following vulnerability in Canonical LXD enables authenticated attackers to perform unauthorized file operations on the host system by exploiting improper symbolic link validation.

This is an improper link resolution vulnerability (CWE-59) where the application fails to validate symbolic links during the unpacking of image archives. An authenticated attacker can use this to point the metadata.yaml file to sensitive locations on the host, facilitating arbitrary file reads or writes.

This vulnerability carries a CVSS score of 9.9, reflecting its potential for full host system compromise. By manipulating file access, an attacker could extract sensitive credentials or modify system configuration files, severely impacting the security posture of the entire infrastructure managed by LXD.

Immediate Action: Apply the vendor-provided security patches by upgrading to LXD version 4.0.12, 5.0.8, 5.12.6, or 6.10 (or later).

Proactive Monitoring: Monitor host file system integrity and review logs for suspicious activity involving image archive ingestion or unusual file access patterns.

Compensating Controls: Implement strict access control lists for image storage and limit the ability of non-privileged users to trigger image import processes.

Public Exploit Available: No

Given the critical CVSS rating, immediate remediation is required. Organizations should identify all affected LXD installations and schedule upgrades to the specified patched versions to mitigate the risk of unauthorized host file access.