CVE-2025-54292CWE-22path-traversal

CVE-2025-54292

Medium · published October 2, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-02T14:15Z
Affected products (2)
ProductVersionsFixed in
canonical/lxd≥ 5.0.0, < 5.21.45.21.4
canonical/lxd≥ 6.0, < 6.56.5
References (2)
https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3 · [email protected]https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 09:26Z
    Client-Side Path Traversal in LXD-UI
    cvelistv5