Më 6 nëntor 2026, GitHub publikoi këshillën e sigurisë GHSA-vghh-5rfx-xhq8 për një dobësi me rrezikshmëri kritike (CVSS 9.9) në paketën github.com/canonical/lxd të ekosistemit Go.
Paketat e prekura
- github.com/canonical/lxd (Go) — versionet e prekura:
< 0.0.0-20260630083100-c5184be310b1; versioni me rregullim:0.0.0-20260630083100-c5184be310b1
Detaje
- Rrezikshmëria: Kritike (CVSS 9.9)
- CWE: CWE-73 (External Control of File Name or Path)
- Identifikuesit: GHSA-vghh-5rfx-xhq8
Përmbledhja zyrtare (në anglisht)
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image — Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it sees a normal metadata.yaml and a rootfs/ entry, but full extraction can later process a duplicate top-level rootfs symlink. Later, the stopped-container file API opens d.RootfsPath() and passes that file descriptor to forkfile , which chroots to it. In practice, this allows a malicious actor…
Çfarë duhet të bëni
Nëse projektet tuaja përdorin github.com/canonical/lxd, përditësojeni sa më shpejt në versionin 0.0.0-20260630083100-c5184be310b1 ose më të ri.
