CVE-2026-48749: Arbitrary Host File Read and Write via Malicious Image Symlink in Canonical LXD and Incus

Vulnerability ID: GHSA-VGHH-5RFX-XHQ8
CVSS Score: 9.9
Published: 2026-11-06

CVE-2026-48749 (tracked as GHSA-vghh-5rfx-xhq8 for LXD and GHSA-2q3f-q5pq-g8wv for Incus) is a critical container escape vulnerability in the Canonical LXD and Linux Containers Incus system container managers. By importing a specially crafted container image archive containing duplicate tar member headers, an authenticated attacker can replace the instance rootfs directory with a symbolic link pointing to the underlying host root filesystem. When performing file operations on a stopped container, the privileged forkfile helper binary resolves the symbolic link without confinement and chroots directly into the host filesystem, granting arbitrary root-level file read and write access.

TL;DR

A tar extraction validation bypass and unconfined symlink resolution flaw in Canonical LXD and Incus allows authenticated users with image import permissions to replace a container's rootfs directory with a symlink to the host root filesystem, resulting in arbitrary file read, arbitrary file write, and complete host compromise as root.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-48749 (GHSA-vghh-5rfx-xhq8 / GHSA-2q3f-q5pq-g8wv)
• Weakness Class: CWE-73: External Control of File Name or Path
• CVSS v3.1 Score: 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
• EPSS Score: 0.78% (56.22nd Percentile)
• Attack Vector: Authenticated API / Malicious Container Image Import
• Security Impact: Container Escape via Arbitrary Host File Read and Write as Root
• Exploit Status: Public Proof-of-Concept (PoC) Available
• CISA KEV Status: Not Listed

Affected Systems

• Canonical LXD
• Linux Containers Incus
• LXD: >= 4.0.0, < 4.0.11 (Fixed in: 4.0.11)
• LXD: >= 5.0.0, < 5.0.7 (Fixed in: 5.0.7)
• LXD: >= 5.1.0, < 5.21.5 (Fixed in: 5.21.5)
• LXD: >= 6.0.0, < 6.9.0 (Fixed in: 6.9.0)
• Incus: < 7.2.0 (Fixed in: 7.2.0)

Code Analysis

Commit: 190e245

Canonical LXD security patch for rootfs and templates path validation (CVE-2026-48749).

Commit: 254b85c

Canonical LXD security patch enforcing symlink checks and path confinement.

Commit: 3dbf4ce

Canonical LXD backport commit addressing GHSA-vghh-5rfx-xhq8.

Commit: 4cd6334

Canonical LXD commit updating instance rootfs access methods.

Commit: 51dc11e

Canonical LXD commit confining subdirectory operations within instance paths.

Commit: 62bcee5

Canonical LXD patch preventing symlink traversal in instance drivers.

Commit: 8751ea6

Canonical LXD backport patch for CVE-2026-48749.

Commit: b499ec4

Canonical LXD commit hardening template and rootfs path resolution.

Commit: e2aeca6

Canonical LXD fix for rootfs symlink resolution in forkfile operations.

Commit: edb6d99

Canonical LXD commit introducing subPath symlink rejection.

Exploit Details

• GitHub Security Advisory (LXD): Official Canonical LXD advisory containing functional shell script Proof-of-Concept demonstrating arbitrary host file read and write.
• GitHub Security Advisory (Incus): Official Linux Containers Incus advisory detailing the rootfs symlink arbitrary file read/write exploit.

Mitigation Strategies

• Upgrade Canonical LXD and Linux Containers Incus to the latest patched point releases.
• Restrict LXD/Incus Unix socket membership and remote REST API access to trusted host administrators only.
• Disable custom image imports for untrusted or multi-tenant project users until patches are applied.
• Monitor storage pool directories for symbolic links named 'rootfs' or 'templates' and audit forkfile helper executions.

Remediation Steps:

1. Identify all hosts running Canonical LXD (< 4.0.11, < 5.0.7, < 5.21.5, < 6.9.0) or Incus (< 7.2.0).
2. Audit storage pool directories using 'find /var/lib/lxd/storage-pools/ -maxdepth 3 -type l -name rootfs' and 'find /var/lib/incus/storage-pools/ -maxdepth 3 -type l -name rootfs' to verify no malicious instances exist.
3. Apply vendor updates via snap, apt, or distribution package managers to upgrade LXD to 4.0.11 / 5.0.7 / 5.21.5 / 6.9.0+ or Incus to 7.2.0+.
4. Restart the LXD or Incus daemon if not automatically handled by the package manager and verify version status.

References

• GitHub Security Advisory: GHSA-vghh-5rfx-xhq8 (Canonical LXD)
• GitHub Security Advisory: GHSA-2q3f-q5pq-g8wv (LXC Incus)
• NVD Vulnerability Detail: CVE-2026-48749
• CVE.org Official Record: CVE-2026-48749
• Canonical LXD Source Repository
• Announcing Incus 7.2

Read the full report for GHSA-VGHH-5RFX-XHQ8 on our website for more details including interactive diagrams and full exploit analysis.