CVE-2025-54292 Client-Side Path Traversal in LXD-UI
Authenticated attackers can access or modify unintended resources in LXD-UI via crafted resource names in URL paths.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-54292?
CVE-2025-54292 is a medium-severity path traversal vulnerability in Canonical LXD, published on 2 Oct 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.
Weakness: CWE-22
Which versions are affected by CVE-2025-54292?
It affects 1 product.
Products include Canonical Lxd.
How do I fix CVE-2025-54292?
No fix has been published for CVE-2025-54292 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-54292 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54292 exists.
Other vulnerabilities in Canonical LXD
- CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root
- CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag
- CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
- CVE-2026-63294 Root RCE via image backup.yaml symlink
- CVE-2026-63296 Project restriction bypass via instance migration config override
Sources
Also known as GHSA-7425-4qpj-v4w3.