A vulnerability in LXD allows a specially crafted container image to read and write arbitrary files on the host system by exploiting a symlink named 'templates' in the image. This can lead to arbitrary command execution on the host. The flaw arises because the tar extraction process does not reject a top-level 'templates' symlink, enabling access to host directories such as /etc/cron.d. A proof of concept demonstrates creating a cron job on the host via this method. The vulnerability is critical with a CVSS score of 9.9 and has been fixed in version 0.0.0-20260203144152-d1c8ba15d160.