CVE-2025-54287 HIGH

CVE-2025-54287: Arbitrary File Read via Template Injection in Snapshot Patterns

Vendor Canonical
Product LXD
Weakness CWE-1336
Published October 2, 2025
Last update October 2, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.

Key dates

02Disclosure timeline

October 2, 2025 CVE published
October 2, 2025 Record updated