Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63293— Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

CVSS 9.9 · Critical EPSS 0.38% · P31

Affected Version Matrix 4

VendorProductVersion RangeStatus
CanonicalLXD4.0.0< 4.0.12affected
5.0.0< 5.0.8affected
5.21.0< 5.21.6affected
6.0< 6.10affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-63293

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
Source: CVE Program / CVE List V5
Vulnerability Description
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Vulnerability Title
Canonical LXD 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Canonical LXD是英国Canonical公司开源的一款基于Linux系统用于管理应用程序的容器。 Canonical LXD 4.0.0至4.0.12之前版本、5.0.0至5.0.8之前版本、5.21.0至5.21.6之前版本和6.0至6.10之前版本存在后置链接漏洞，该漏洞源于在处理镜像归档时未验证metadata.yaml文件是否为符号链接，攻击者可通过特制的镜像归档利用指向主机系统目标文件路径的符号链接，实现任意文件读取和写入操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
CanonicalLXD 4.0.0 ~ 4.0.12 -

II. Public POCs for CVE-2026-63293

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8408 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-63293

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-63293 (1)

Same Patch Batch · Canonical · 2026-08-12 · 11 CVEs total

CVE-2026-624209.9 CRITICALCross-project cluster migration bypasses project restrictions via cluster notification fla
CVE-2026-633009.9 CRITICALCross-project instance move bypasses all project restrictions allowing host command execut
CVE-2026-632969.9 CRITICALProject restriction bypass via instance migration config override
CVE-2026-632949.9 CRITICALRoot RCE via image backup.yaml symlink
CVE-2026-632979.9 CRITICALCross-project instance copy bypasses target project restrictions via TOCTOU in config merg
CVE-2026-668989.9 CRITICALPath traversal via unvalidated instance name in backup tarball restore enables root file w
CVE-2026-632988.7 HIGHLXD arbitrary lxc.conf directive injection via NVIDIA instance configuration
CVE-2026-632998.5 HIGHStorage volume cross-project move and snapshot restore bypass project disk limits
CVE-2026-160338.5 HIGHArbitrary file read+write on host via templates/ symlink in malicious image
CVE-2026-632954.3 MEDIUMProject restriction `restricted.containers.privilege=isolated` bypassable by omitting `sec

IV. Related Vulnerabilities

Same product: LXD
Same vendor: Canonical
Same weakness: CWE-59

V. Comments for CVE-2026-63293

No comments yet

Leave a comment