CVE-2025-54291: canonical lxd
CVSS: 6.9v4.0MediumAnalyzed
AliasesUBUNTU-CVE-2025-54291DEBIAN-CVE-2025-54291GHSA-xch9-h8qw-85c7GO-2025-4005
Published 02-10-2025Last modified 02-10-2025
Vulnerability summary
CVE-2025-54291 is a medium (CVSS 6.9) vulnerability in canonical lxd. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 02-10-2025PublishedVulnerability first disclosed.
- 02-10-2025Last modifiedVulnerability information updated.
Description
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
CVSS metrics
8 scores · 5 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 4 agree
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 19-09-2026
19-09-202619-10-2026
EPSS score0.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLxd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- incus< 6.0.4-2+deb13u1 | < 6.0.5-1
- lxdAll versions (No fix recorded)
Canonical1 product
- lxd≥ 6.0, < 6.5 | ≥ 5.21, < 5.21.4 | ≥ 4.0.0, < 5.21.4 | ≥ 6.1, < 6.5
Github.com/canonical1 product
- lxd≥ 4.0, < 5.21.4 | ≥ 6.0, < 6.5 | ≥ 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
Ubuntu1 product
- lxdAll versions (No fix recorded)
4 vendors · 5 products
References
7 links- github.com/canonical/lxd/security/advisories/GHSA-xch9-h8qw-85c7REPORTWEBAdvisoryExploitVendor Advisory
- github.com/canonical/lxdPACKAGE