CVE-2025-54293
📋 TL;DR
This path traversal vulnerability in Canonical LXD 5.0 LTS allows authenticated remote attackers to read arbitrary files on the host system by manipulating log file names or symbolic links. It affects systems running LXD 5.0 LTS with authenticated access enabled. Attackers can potentially access sensitive system files and configuration data.
💻 Affected Systems
- Canonical LXD
📦 What is this software?
Lxd by Canonical
Lxd by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full read access to sensitive host files including SSH keys, configuration files, passwords, and other credentials, potentially leading to complete system compromise.
Likely Case
Attackers read sensitive configuration files, application secrets, or user data stored on the host system, enabling further attacks or data exfiltration.
If Mitigated
With proper network segmentation and authentication controls, impact is limited to reading non-critical files within accessible directories.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.1 or later
Vendor Advisory: https://github.com/canonical/lxd/security/advisories/GHSA-472f-vmf2-pr3h
Restart Required: Yes
Instructions:
1. Update LXD to version 5.0.1 or later using your package manager. 2. Restart the LXD service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Restrict LXD API Access
linuxLimit network access to LXD API endpoints to trusted networks only
sudo ufw deny from any to any port 8443
sudo ufw allow from 192.168.1.0/24 to any port 8443
Disable Remote API Access
linuxTemporarily disable remote API access if not required
sudo systemctl stop lxd
sudo lxd init --auto --network-address=''
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LXD instances from sensitive systems
- Enforce strong authentication and limit user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Check LXD version: lxd --version should show 5.0.0Check Version:
lxd --versionVerify Fix Applied:
Verify version is 5.0.1 or later: lxd --version📡 Detection & Monitoring
Log Indicators:
- Unusual log file access patterns
- Failed attempts to access system files via LXD API
- Multiple requests for non-standard log file names
Network Indicators:
- Unusual API requests to log endpoints with path traversal patterns
- Requests containing '../' sequences in log file parameters
SIEM Query:
source="lxd" AND (path="*../*" OR file="*../*")