cve.bz

CVE-2025-54290

6.9 mediumEPSS 0.3%

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

CVSS 4.0
6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-25)
CWE
CWE-200
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-p3x5-mvmp-5f35Gogithub.com/canonical/lxd>=4.0 <5.21.45.21.4
GHSA-p3x5-mvmp-5f35Gogithub.com/canonical/lxd>=6.0 <6.56.5
GHSA-p3x5-mvmp-5f35Gogithub.com/canonical/lxd>=0.0.0-20200331193331-03aab09f5b5c <0.0.0-20250827065555-0494f5d47e410.0.0-20250827065555-0494f5d47e41
GO-2025-4002Gogithub.com/canonical/lxd>=0.0.0-20200331193331-03aab09f5b5c <0.0.0-20250827065555-0494f5d47e410.0.0-20250827065555-0494f5d47e41

References

Check your stackJSON