Symlink following arbitrary file read/write in LXD (CVE-2026-63293)

LXD fails to validate whether the metadata.yaml file within an image archive is a symbolic link during image import or unpacking. An authenticated user can supply a crafted image archive containing a symlinked metadata.yaml pointing to an arbitrary host path, then use the instance metadata API to read or overwrite any file on the host as root. The tar `--restrict` flag prevents following symlinks during extraction but does not prevent writing symlink entries to disk, and no Lstat or os.OpenRoot guard is applied to the resolved metadataPath in the metadata get and put handlers. Affected versions: - >= 4.0 We recommend updating to: 4.0.12, 5.0.8, 5.21.6, 6.10. CVSS 9.9 · our assessment: act_now Reference: https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5 Details: https://vuln.today/cve/CVE-2026-63293