← CVE Intelligence

CVE-2025-54287

Arbitrary File Read via Template Injection in Snapshot Patterns PUBLISHED

Description (CNA)

Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.

Affected (CNA)

Vendor / productVersions
Canonical / LXDaffected 6.0 before 6.5; affected 5.21 before 5.21.4

CWE

CWE-1336

References

ADP enrichment

CISA-ADP

No English description supplied.