CVE-2025-54292
📋 TL;DR
This path traversal vulnerability in Canonical LXD LXD-UI allows authenticated attackers to access or modify resources outside intended directories by manipulating URL paths. It affects all platforms running LXD-UI versions before 6.5 and 5.21.4. Only authenticated users can exploit this vulnerability.
💻 Affected Systems
- Canonical LXD LXD-UI
📦 What is this software?
Lxd by Canonical
Lxd by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attackers could read sensitive system files, modify configuration, or access other container data leading to privilege escalation or data exfiltration.
Likely Case
Authenticated users accessing unintended container resources or configuration files they shouldn't have access to.
If Mitigated
Limited impact with proper authentication controls and network segmentation in place.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of resource naming patterns
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5 or 5.21.4
Vendor Advisory: https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3
Restart Required: Yes
Instructions:
1. Update LXD-UI to version 6.5 or 5.21.4
2. Restart LXD service
3. Verify the update was successful
🔧 Temporary Workarounds
Restrict LXD-UI Access
allLimit network access to LXD-UI interface to trusted networks only
Configure firewall rules to restrict access to LXD-UI port (default 8443)
Implement Strong Authentication
allEnforce strong authentication policies and limit user privileges
Review and tighten LXD user permissions and authentication methods
🧯 If You Can't Patch
- Implement network segmentation to isolate LXD-UI from sensitive systems
- Enable detailed logging and monitoring for suspicious path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check LXD-UI version with: lxc version | grep -i uiCheck Version:
lxc version | grep -i uiVerify Fix Applied:
Confirm version is 6.5 or higher, or 5.21.4 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual path patterns in LXD-UI access logs
- Multiple failed path traversal attempts
- Access to unexpected resource names
Network Indicators:
- Unusual patterns of requests to LXD-UI with crafted paths
- Multiple requests with ../ patterns
SIEM Query:
source="lxd-ui" AND (path="*../*" OR path="*..\\*" OR resource="*unusual*pattern*")