CVE-2026-63293

Name of the Vulnerable Software and Affected Versions LXD (affected versions not specified)

Description A link following flaw allows an attacker to perform arbitrary file read and write operations on the host system. The issue occurs during the import or unpacking of an image archive because the system fails to validate if the metadata.yaml file is a symbolic link. An attacker can exploit this by using a crafted image archive containing a symlinked metadata.yaml file that points to target file paths on the host system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.