CVE-2025-54287
02.10.2025, 10:15
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.Enginsight
| Vendor | Product | Version |
|---|---|---|
| canonical | lxd | 4.0.0 ≤ 𝑥 < 5.21.4 |
| canonical | lxd | 6.1 ≤ 𝑥 < 6.5 |
𝑥
= Vulnerable software versions
Ubuntu Releases