CVE-2025-54290
published 2025-10-02CVE-2025-54290: Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.32%
23.6th percentile
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 4.0.0 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 5.21 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 6.0 < 6.5 | 6.5 |
| canonical | lxd | >= 6.1 < 6.5 | 6.5 |
| debian | incus | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| debian | lxd | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| github.com | canonical_lxd | >= 0.0.0-20200331193331-03aab09f5b5c < 0.0.0-20250827065555-0494f5d47e41 | 0.0.0-20250827065555-0494f5d47e41 |
| github.com | canonical_lxd | >= 4.0 < 5.21.4 | 5.21.4 |
| github.com | canonical_lxd | >= 6.0 < 6.5 | 6.5 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.9MEDIUM
vendor_debian6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd
osv·2025-11-05
CVE-2025-54290 Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd
OSV
CVE-2025-54290: Information disclosure in image export API in Canonical LXD before 6
osv·2025-10-02·CVSS 6.9
CVE-2025-54290 [MEDIUM] CVE-2025-54290: Information disclosure in image export API in Canonical LXD before 6
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
OSV
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function
osv·2025-10-02
CVE-2025-54290 [MEDIUM] Canonical LXD Project Existence Determination Through Error Handling in Image Export Function
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function
### Impact
In LXD's images export API (`/1.0/images/{fingerprint}/export`), implementation differences in error handling allow determining project existence without authentication.
Specifically, in the following code, errors when multiple images match are directly returned to users as API responses:
https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/db/images.go#L239-L246
While fingerprints generally don't duplicate, this functionality uses fingerprints with LIKE clauses, allowing prefix specification. Therefore, using LIKE wildcards such as % will match multiple images if multiple images exist in the project.
https://github.com/canonical/lxd/blob/43d5189564d27
GHSA
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function
ghsa·2025-10-02
CVE-2025-54290 [MEDIUM] CWE-200 Canonical LXD Project Existence Determination Through Error Handling in Image Export Function
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function
### Impact
In LXD's images export API (`/1.0/images/{fingerprint}/export`), implementation differences in error handling allow determining project existence without authentication.
Specifically, in the following code, errors when multiple images match are directly returned to users as API responses:
https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/db/images.go#L239-L246
While fingerprints generally don't duplicate, this functionality uses fingerprints with LIKE clauses, allowing prefix specification. Therefore, using LIKE wildcards such as % will match multiple images if multiple images exist in the project.
https://github.com/canonical/lxd/blob/43d5189564d27
Debian
CVE-2025-54290: incus - Information disclosure in image export API in Canonical LXD before 6.5 and 5.21....
vendor_debian·2025·CVSS 6.9
CVE-2025-54290 [MEDIUM] CVE-2025-54290: incus - Information disclosure in image export API in Canonical LXD before 6.5 and 5.21....
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
Scope: local
forky: resolved (fixed in 6.0.5-1)
sid: resolved (fixed in 6.0.5-1)
trixie: resolved (fixed in 6.0.4-2+deb13u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-02
Published