CVE-2025-54287
published 2025-10-02CVE-2025-54287: Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read…
PriorityP343medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.34%
26.3th percentile
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration
permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 0 < 5.0.2-5+deb12u1 | 5.0.2-5+deb12u1 |
| canonical | lxd | >= 0 < 5.0.2+git20231211.1364ae4-9+deb13u1 | 5.0.2+git20231211.1364ae4-9+deb13u1 |
| canonical | lxd | >= 4.0.0 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 5.21 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 6.0 < 6.5 | 6.5 |
| canonical | lxd | >= 6.1 < 6.5 | 6.5 |
| debian | incus | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| debian | lxd | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| github.com | lxc_lxd | >= 0.0.0-20200331193331-03aab09f5b5c < 0.0.0-20250827065555-0494f5d47e41 | 0.0.0-20250827065555-0494f5d47e41 |
| github.com | lxc_lxd | >= 4.0.0 < 5.21.4 | 5.21.4 |
| github.com | lxc_lxd | >= 6.0.0 < 6.5.0 | 6.5.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.1HIGH
vendor_debian7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-54287: incus - Template Injection in instance snapshot creation component in Canonical LXD (>= ...
vendor_debian·2025·CVSS 7.1
CVE-2025-54287 [HIGH] CVE-2025-54287: incus - Template Injection in instance snapshot creation component in Canonical LXD (>= ...
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
Scope: local
forky: resolved (fixed in 6.0.5-1)
sid: resolved (fixed in 6.0.5-1)
trixie: resolved (fixed in 6.0.4-2+deb13u1)
OSV
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd
osv·2025-11-05
CVE-2025-54287 Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd
OSV
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
osv·2025-10-02
CVE-2025-54287 [HIGH] Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
### Impact
In LXD's instance snapshot creation functionality, the Pongo2 template engine is used in the `snapshots.pattern` configuration for generating snapshot names. While code execution functionality has not been found in this template engine, it has file reading capabilities, creating a vulnerability that allows arbitrary file reading through template injection attacks.
### Reproduction Steps
1. Log in to LXD-UI with an account that has permissions to modify instance settings
2. Set the following template injection payload in the instance snapshot pattern:
```
{% filter urlencode|slice:":100" %}{% include "/etc/passwd" %}{%endfilter %}
```
Note that the above template uses the Pongo2 template engine's i
GHSA
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
ghsa·2025-10-02
CVE-2025-54287 [HIGH] CWE-1336 Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
### Impact
In LXD's instance snapshot creation functionality, the Pongo2 template engine is used in the `snapshots.pattern` configuration for generating snapshot names. While code execution functionality has not been found in this template engine, it has file reading capabilities, creating a vulnerability that allows arbitrary file reading through template injection attacks.
### Reproduction Steps
1. Log in to LXD-UI with an account that has permissions to modify instance settings
2. Set the following template injection payload in the instance snapshot pattern:
```
{% filter urlencode|slice:":100" %}{% include "/etc/passwd" %}{%endfilter %}
```
Note that the above template uses the Pongo2 template engine's i
OSV
CVE-2025-54287: Template Injection in instance snapshot creation component in Canonical LXD (>= 4
osv·2025-10-02·CVSS 7.1
CVE-2025-54287 [HIGH] CVE-2025-54287: Template Injection in instance snapshot creation component in Canonical LXD (>= 4
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-02
Published