> CVE-2025-54287

« BACK_TO_HOME
PUBLISHED
2025-10-02 10:15
MODIFIED
2025-10-02 19:11
EPSS (Prob. Exploit)
0.38%
Top 68.3%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-w2hg-2v4p-vmh6 HIGH

Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns

AFFECTED PACKAGES:
GO / github.com/lxc/lxd
>= 6.0.0, < 6.5.0
Fixed in: 6.5.0
GO / github.com/lxc/lxd
>= 4.0.0, < 5.21.4
Fixed in: 5.21.4
GO / github.com/lxc/lxd
>= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
Fixed in: 0.0.0-20250827065555-0494f5d47e41

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Arbitrary File Read via Template Injection in Snapshot Patterns

AFFECTED PACKAGES:
Unknown / Unknown
144 versions affected
ALIASES:
GHSA-w2hg-2v4p-vmh6, GO-2025-4004

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/10/2025 10:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME