CVE-2025-54293CWE-22path-traversal

CVE-2025-54293

Medium · published October 2, 2025

CVSS v3.1

6.5

EPSS

Percentile

47.7

In the wild

Unconfirmed

What it is

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00594 · 47.7th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2025-10-02T15:15Z

Affected products (2)

Product	Versions	Fixed in
canonical/lxd	≥ 4.0.0, < 5.21.4	5.21.4
canonical/lxd	≥ 6.0, < 6.5	6.5

References (2)

https://github.com/canonical/lxd/security/advisories/GHSA-472f-vmf2-pr3h · [email protected]https://github.com/canonical/lxd/security/advisories/GHSA-472f-vmf2-pr3h · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

02 OCT 10:43Z
Path Traversal in LXD Instance Log File Retrieval
cvelistv5