CVE-2025-54290

MEDIUM

Canonical LXD < 5.21.4 - Unauthenticated Information Disclosure via Image Export API

Title source: llm

Description

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

References (1)

Core 1

Core References

Exploit, Vendor Advisory

https://github.com/canonical/lxd/security/advisories/GHSA-p3x5-mvmp-5f35

Scores

CVSS v3 5.3

EPSS 0.0012

EPSS Percentile 30.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-200

Status published

Products (2)

canonical/lxd 4.0 - 5.21.4Go

canonical/lxd 4.0.0 - 5.21.4

Published Oct 02, 2025

Tracked Since Feb 18, 2026