CVE-2025-54290 — Project Existence Disclosure via Error Handling in LXD Image Export

CVE-2025-54290

Project Existence Disclosure via Error Handling in LXD Image Export PUBLISHED

Description (CNA)

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

Affected (CNA)

Vendor / product	Versions
Canonical / LXD	affected 6.0 before 6.5; affected 5.21 before 5.21.4

CWE

CWE-200

References

https://github.com/canonical/lxd/security/advisories/GHSA-p3x5-mvmp-5f35

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.