CVE-2025-54291 Project existence disclosure in LXD images API

What is CVE-2025-54291?

CVE-2025-54291 is a medium-severity vulnerability in Canonical LXD, published on 2 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Weakness: CWE-209

Which versions are affected by CVE-2025-54291?

7 open source packages ship an affected version, including github.com/canonical/lxd. It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2025-54291?

Upgrade github.com/canonical/lxd to a fixed version for your release line: 0.0.0-20250827065555-0494f5d47e41, 5.21.4 or 6.5.

Is CVE-2025-54291 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54291 exists.

Other vulnerabilities in Canonical LXD

• CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root Critical 9.9
• CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag Critical 9.9
• CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root Critical 9.9
• CVE-2026-63294 Root RCE via image backup.yaml symlink Critical 9.9
• CVE-2026-63296 Project restriction bypass via instance migration config override Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-54291, GHSA-xch9-h8qw-85c7, GO-2025-4005.