LXD contains a vulnerability where the 'exec-output' directory can be a symlink, allowing files to be written to arbitrary locations on the host. This can be exploited to create files such as cron jobs, enabling arbitrary command execution on the host system. The issue arises because top-level symlinks in unpacked images are preserved, and the code follows the symlink when writing output files. A proof-of-concept demonstrates placing a malicious file in /etc/cron.d to achieve code execution.