CVE-2025-54290CWE-200information-disclosure
CVE-2025-54290
Medium · published October 2, 2025
What it is
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00337 · 25.8th percentile
- Weakness
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- Published
- 2025-10-02T14:15Z
Affected products (2)
| Product | Versions | Fixed in |
|---|
| canonical/lxd | ≥ 4.0.0, < 5.21.4 | 5.21.4 |
| canonical/lxd | ≥ 6.1, < 6.5 | 6.5 |
References (1)
EPSS history
Timeline