CVE-2025-54293
published 2025-10-02CVE-2025-54293: Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host…
PriorityP342medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.54%
41.7th percentile
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 0 < 5.0.2-5+deb12u1 | 5.0.2-5+deb12u1 |
| canonical | lxd | >= 0 < 5.0.2+git20231211.1364ae4-9+deb13u1 | 5.0.2+git20231211.1364ae4-9+deb13u1 |
| canonical | lxd | >= 4.0.0 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 5.21 < 5.21.4 | 5.21.4 |
| canonical | lxd | >= 6.0 < 6.5 | 6.5 |
| debian | incus | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| debian | lxd | < incus 6.0.5-1 (forky) | incus 6.0.5-1 (forky) |
| github.com | canonical_lxd | >= 0.0.0-20200331193331-03aab09f5b5c < 0.0.0-20250224180022-ec09b24179f3 | 0.0.0-20250224180022-ec09b24179f3 |
| github.com | canonical_lxd | >= 4.0 < 5.21.4 | 5.21.4 |
| github.com | canonical_lxd | >= 6.0 < 6.5 | 6.5 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.1HIGH
vendor_debian7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd
osv·2025-11-05
CVE-2025-54293 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd
OSV
CVE-2025-54293: Path Traversal in the log file retrieval function in Canonical LXD 5
osv·2025-10-02·CVSS 7.1
CVE-2025-54293 [HIGH] CVE-2025-54293: Path Traversal in the log file retrieval function in Canonical LXD 5
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
GHSA
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function
ghsa·2025-10-02
CVE-2025-54293 [HIGH] CWE-22 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function
### Impact
Although outside the scope of this penetration test, a path traversal vulnerability exists in the validLogFileName function that validates log file names in lxd/instance_logs.go in the LXD 5.0 LTS series.
This vulnerability was fixed in PR #15022 in February 2025, and is fixed in at least LXD 5.21 and later. However, this PR appears to be primarily aimed at code improvement rather than vulnerability fixing, with the vulnerability being fixed as a side effect. Therefore, no CVE number has been issued, and no security patch has been made for LXD 5.0 and earlier.
However, since LXD 5.0 LTS is still in its support period and installation procedures are explained in official documentation, we judge
OSV
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function
osv·2025-10-02
CVE-2025-54293 [HIGH] Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function
### Impact
Although outside the scope of this penetration test, a path traversal vulnerability exists in the validLogFileName function that validates log file names in lxd/instance_logs.go in the LXD 5.0 LTS series.
This vulnerability was fixed in PR #15022 in February 2025, and is fixed in at least LXD 5.21 and later. However, this PR appears to be primarily aimed at code improvement rather than vulnerability fixing, with the vulnerability being fixed as a side effect. Therefore, no CVE number has been issued, and no security patch has been made for LXD 5.0 and earlier.
However, since LXD 5.0 LTS is still in its support period and installation procedures are explained in official documentation, we judge
Debian
CVE-2025-54293: incus - Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Li...
vendor_debian·2025·CVSS 7.1
CVE-2025-54293 [HIGH] CVE-2025-54293: incus - Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Li...
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
Scope: local
forky: resolved (fixed in 6.0.5-1)
sid: resolved (fixed in 6.0.5-1)
trixie: resolved (fixed in 6.0.4-2+deb13u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-02
Published