cve.bz

CVE-2025-54291

6.9 mediumEPSS 0.4%

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

CVSS 4.0
6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)
CWE
CWE-209
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xch9-h8qw-85c7Gogithub.com/canonical/lxd>=4.0 <5.21.45.21.4
GHSA-xch9-h8qw-85c7Gogithub.com/canonical/lxd>=6.0 <6.56.5
GHSA-xch9-h8qw-85c7Gogithub.com/canonical/lxd>=0.0.0-20200331193331-03aab09f5b5c <0.0.0-20250827065555-0494f5d47e410.0.0-20250827065555-0494f5d47e41
GO-2025-4005Gogithub.com/canonical/lxd>=0.0.0-20200331193331-03aab09f5b5c <0.0.0-20250827065555-0494f5d47e410.0.0-20250827065555-0494f5d47e41

References

Check your stackJSON