A critical link following vulnerability in Canonical LXD allows authenticated attackers to execute arbitrary commands with root privileges on the host system.

This is an improper link resolution vulnerability (CWE-59) triggered during the import or unpacking of archives. By using a symlinked backup.yaml file, an attacker forces LXD to process unconfined configuration metadata, leading to arbitrary command execution with root-level privileges.

With a CVSS score of 9.9, this vulnerability poses the highest possible risk to organizational security. Successful exploitation grants the attacker full control over the host system, enabling complete data exfiltration, service disruption, or the deployment of persistent threats within the environment.

Immediate Action: Upgrade to LXD version 4.0.12, 5.0.8, 5.12.6, or 6.10 (or later) to address the underlying symlink validation logic.

Proactive Monitoring: Audit logs for unauthorized execution of commands or unusual process spawning during archive operations.

Compensating Controls: Ensure that the LXD daemon is running with the least privilege necessary and isolate the import functionality from untrusted sources.

Public Exploit Available: No

This vulnerability is critical and requires immediate attention. Security teams must ensure that all LXD environments are updated to the latest patched versions to prevent potential root command execution and total host compromise.