Threats tagged 'ghsa-472f-vmf2-pr3h'

A path traversal vulnerability exists in the validLogFileName function of the LXD 5.0 LTS series, allowing attackers with access to LXD-UI to read arbitrary files on the LXD host by exploiting insufficient validation of log file names. The issue also affects the validExecOutputFileName function, enabling attackers with command execution privileges inside containers to create symbolic links and access host files. This vulnerability was fixed as a side effect in LXD 5.21.4 and later versions. The flaw could lead to disclosure of sensitive host configuration files, LXD database files, and data from other instances.