CyberRota Analysis
AI-GeneratedA critical path traversal vulnerability in LXD's instance template processing allows attackers with container edit permissions to overwrite arbitrary files on the host system as root. This flaw arises from improper validation of file paths, enabling attackers to escape directory confinement and execute code with root privileges on the host. Organizations utilizing LXD, particularly those managing containerized applications, should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.
Related CVEs
Other vulnerabilities affecting the same vendor(s)