CVE-2025-54287

EUVD-2025-32636
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration 
permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.41%
Affected Products (NVD)
VendorProductVersion
canonicallxd
4.0.0 ≤
𝑥
< 5.21.4
canonicallxd
6.1 ≤
𝑥
< 6.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
incus
forky
7.0.1-2
fixed
sid
7.0.1-2
fixed
trixie
6.0.4-2+deb13u8
fixed
trixie (security)
6.0.4-2+deb13u9
fixed
lxd
bookworm
vulnerable
bookworm (security)
vulnerable
trixie
5.0.2+git20231211.1364ae4-9+deb13u7
fixed
trixie (security)
5.0.2+git20231211.1364ae4-9+deb13u7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
lxd
bionic
not-affected
focal
not-affected
jammy
dne
noble
dne
plucky
dne
questing
dne
xenial
not-affected
Common Weakness Enumeration
References
https://github.com/canonical/lxd/security/advisories/GHSA-w2hg-2v4p-vmh6
https://github.com/canonical/lxd/security/advisories/GHSA-w2hg-2v4p-vmh6