CVE-2025-54287
CVE-2025-54287 · Arbitrary File Read via Template Injection in Snapshot Patterns
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
CVSS 7.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
lxd
- Versions
- ≥ 6.0, < 6.5: Affected (semver)
- ≥ 5.21, < 5.21.4: Affected (semver)
Update to 5.21.4; Update to 6.5
incus Debian:13
- Versions
- 6.0.4-2
- 6.0.4-2+deb13u1~bpo12+1
- Affected ranges
- ECOSYSTEM: < 6.0.4-2+deb13u1
Update to 6.0.4-2+deb13u1
incus Debian:14
- Versions
- 6.0.4-2
- 6.0.4-3
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
lxd Debian:12
- Versions
- 5.0.2+git20231211.1364ae4-1
- 5.0.2+git20231211.1364ae4-2
- 5.0.2+git20231211.1364ae4-3
- 5.0.2+git20231211.1364ae4-4
- 5.0.2+git20231211.1364ae4-5
- 5.0.2+git20231211.1364ae4-6
- 5.0.2+git20231211.1364ae4-7
- 5.0.2+git20231211.1364ae4-8
- 5.0.2+git20231211.1364ae4-9
- 5.0.2-5
- 5.0.2-5+deb12u1
- 5.0.2-5+deb12u2
- 5.0.2-5+deb12u3
- 5.0.2-5+deb12u4
- 5.0.2-5+deb12u5
- 5.0.2-5+deb12u6
- 5.0.2-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Debian:13
- Versions
- 5.0.2+git20231211.1364ae4-9
- Affected ranges
- ECOSYSTEM: < 5.0.2+git20231211.1364ae4-9+deb13u1
Update to 5.0.2+git20231211.1364ae4-9+deb13u1