{"id":"CVE-2025-54287","title":"Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration \npermissions to read arbitrary files on the host system via specially crafted snapshot pattern templates …","summary":"Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration \npermissions to read arbitrary files on the host system via specially crafted snapshot pattern templates …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-1336"],"vendor":"canonical","product":"lxd","affected":["lxd >= 4.0.0, < 5.21.4","lxd >= 6.1, < 6.5"],"patched":["lxd 6.5"],"published":"2025-10-02","updated":"2026-10-12","sourceUpdated":"2026-10-12T15:10:00.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54287","references":[{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-w2hg-2v4p-vmh6","label":"security@ubuntu.com"},{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-w2hg-2v4p-vmh6","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54287"},{"url":"https://github.com/canonical/lxd"},{"url":"https://pkg.go.dev/vuln/GO-2025-4004"}],"tags":["nvd","osv","go"],"epss":0.00375,"epssPercentile":0.31324,"aliases":["GHSA-w2hg-2v4p-vmh6","GO-2025-4004"],"ecosystem":"go","ingestedAt":"2026-07-09T18:56:36.951Z","slug":"CVE-2025-54287","body":"## Overview\n\nTemplate Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration \npermissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.\n\n## Affected\n\n- `lxd >= 4.0.0, < 5.21.4`\n- `lxd >= 6.1, < 6.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `lxd 6.5`\n\n## Package advisory (CVE-2025-54287)\n\nAffected packages:\n\n- `github.com/lxc/lxd >= 4.0.0, < 5.21.4`\n- `github.com/lxc/lxd >= 6.0.0, < 6.5.0`\n- `github.com/lxc/lxd >= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41`\n\nPatched in:\n\n- `github.com/lxc/lxd 5.21.4`\n- `github.com/lxc/lxd 6.5.0`\n- `github.com/lxc/lxd 0.0.0-20250827065555-0494f5d47e41`\n\nSource: https://osv.dev/vulnerability/GHSA-w2hg-2v4p-vmh6","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}