CVE-2025-54293: canonical lxd Path Traversal
CVSS: 7.1v4.0HighAnalyzed
AliasesUBUNTU-CVE-2025-54293DEBIAN-CVE-2025-54293GHSA-472f-vmf2-pr3hGO-2025-4000
Published 02-10-2025Last modified 02-10-2025
Vulnerability summary
CVE-2025-54293 is a high (CVSS 7.1) Path Traversal vulnerability in canonical lxd. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.1/10
010
High · v4.0 (CVE.org)EPSS score
0.58%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 02-10-2025PublishedVulnerability first disclosed.
- 02-10-2025Last modifiedVulnerability information updated.
Description
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
CVSS metrics
8 scores · 5 sources · 2 versionsHigh 7.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesAll 4 agree
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 19-09-2026
19-09-202619-10-2026
EPSS score0.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLxd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- incus< 6.0.4-2+deb13u1 | < 6.0.5-1
- lxdAll versions (No fix recorded) | < 5.0.2+git20231211.1364ae4-9+deb13u1
Canonical1 product
- lxd≥ 5.21, < 5.21.4 | ≥ 4.0.0, < 5.21.4 | ≥ 6.0, < 6.5
Github.com/canonical1 product
- lxd≥ 4.0, < 5.21.4 | ≥ 6.0, < 6.5 | ≥ 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250224180022-ec09b24179f3
Ubuntu1 product
- lxdAll versions (No fix recorded)
4 vendors · 5 products
References
8 links- github.com/canonical/lxd/security/advisories/GHSA-472f-vmf2-pr3hREPORTWEBAdvisoryExploitVendor Advisory
- github.com/canonical/lxdPACKAGE