p PatchFirst

PatchFirst · Latest vulnerabilities

incus vulnerabilities · Page 4

Vulnerabilities published for incus in the last 30 days: 11. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 68

  1. CVE-2025-54293

    High · CVSS 7.1EPSS 0.59%Fix available

    Path Traversal in LXD Instance Log File Retrieval

    Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.

    incusOperating systems
    • Update to 6.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2025-54291

    Medium · CVSS 6.9EPSS 0.39%Fix available

    Project existence disclosure in LXD images API

    Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

    incusOperating systems
    • Update to 6.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2025-54290

    Medium · CVSS 6.9EPSS 0.34%Fix available

    Project Existence Disclosure via Error Handling in LXD Image Export

    Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

    incusOperating systems
    • Update to 6.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2025-54289

    High · CVSS 7.4EPSS 0.21%Fix available

    Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API

    Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

    incusOperating systems
    • Update to 6.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2025-54288

    Medium · CVSS 5.1EPSS 0.35%Fix available

    Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server

    Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

    incusOperating systems
    • Update to 6.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2025-54287

    High · CVSS 7.1EPSS 0.38%Fix available

    Arbitrary File Read via Template Injection in Snapshot Patterns

    Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.

    incusOperating systems
    • Update to 6.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2025-54286

    High · CVSS 7.5EPSS 0.13%Fix available

    CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

    Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.

    incusOperating systems
    • Update to 6.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →