CVE-2025-54290: canonical lxd
CVSS: 6.9v4.0MediumAnalyzed
AliasesUBUNTU-CVE-2025-54290DEBIAN-CVE-2025-54290GHSA-p3x5-mvmp-5f35GO-2025-4002
Published 02-10-2025Last modified 02-10-2025
Vulnerability summary
CVE-2025-54290 is a medium (CVSS 6.9) vulnerability in canonical lxd. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 02-10-2025PublishedVulnerability first disclosed.
- 02-10-2025Last modifiedVulnerability information updated.
Description
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
CVSS metrics
7 scores · 5 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 18-09-2026
18-09-202618-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLxd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- incus< 6.0.4-2+deb13u1 | < 6.0.5-1
- lxdAll versions (No fix recorded)
Canonical1 product
- lxd≥ 6.0, < 6.5 | ≥ 5.21, < 5.21.4 | ≥ 4.0.0, < 5.21.4 | ≥ 6.1, < 6.5
Github.com/canonical1 product
- lxd≥ 4.0, < 5.21.4 | ≥ 6.0, < 6.5 | ≥ 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
Ubuntu1 product
- lxdAll versions (No fix recorded)
4 vendors · 5 products
References
7 links- github.com/canonical/lxd/security/advisories/GHSA-p3x5-mvmp-5f35REPORTWEBAdvisoryExploitVendor Advisory
- github.com/canonical/lxdPACKAGE