CVE-2025-54293 Path Traversal in LXD Instance Log File Retrieval
Authenticated attackers can read arbitrary host files via crafted log names in LXD, requiring immediate patching for system integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54293?
CVE-2025-54293 is a high-severity path traversal vulnerability in Canonical LXD, published on 2 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
Weakness: CWE-22
Which versions are affected by CVE-2025-54293?
7 open source packages ship an affected version, including github.com/canonical/lxd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/canonical/lxd Go | From 0.0.0-20200331193331-03aab09f5b5c | 0.0.0-20250224180022-ec09b24179f3 |
github.com/canonical/lxd Go | From 0.0.0-20200331193331-03aab09f5b5c | 0.0.0-20250224180022-ec09b24179f3 |
github.com/canonical/lxd Go | From 0.0.0-20200331193331-03aab09f5b5c | 0.0.0-20250224180022-ec09b24179f3 |
github.com/canonical/lxd Go | From 4.0 | 5.21.4 |
github.com/canonical/lxd Go | From 4.0 | 5.21.4 |
github.com/canonical/lxd Go | From 6.0 | 6.5 |
1 more packages
github.com/canonical/lxd Go | From 6.0 | 6.5 |
Products include Canonical Lxd.
How do I fix CVE-2025-54293?
Upgrade github.com/canonical/lxd to a fixed version for your release line: 0.0.0-20250224180022-ec09b24179f3, 5.21.4 or 6.5.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-54293 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54293 exists.
Other vulnerabilities in Canonical LXD
- CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root
- CVE-2026-62420 Cross-project cluster migration bypasses project restrictions via cluster notification flag
- CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
- CVE-2026-63294 Root RCE via image backup.yaml symlink
- CVE-2026-63296 Project restriction bypass via instance migration config override
Sources
Also known as DEBIAN-CVE-2025-54293, GHSA-472f-vmf2-pr3h, GO-2025-4000, UBUNTU-CVE-2025-54293.