Listen to this Post
The CVE-2025-54292 vulnerability in Canonical LXD LXD-UI is a path traversal issue affecting versions before 6.5 and 5.21.4. It allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths. The vulnerability arises from insufficient sanitization of user input in the web interface’s URL routing mechanism. When processing requests, the LXD-UI backend directly concatenates user-supplied resource identifiers, such as container or image names, into file system paths without proper validation. Attackers can embed directory traversal sequences (e.g., “../”) within these resource names to bypass access controls. For example, a malicious URL like “/api/v1/containers/../../../etc/passwd” could be used to read sensitive system files. This occurs because the application fails to normalize paths before resolving them, allowing traversal outside the intended directory scope. The attack requires authentication but has low complexity, making exploitation viable for authorized users. The flaw enables horizontal privilege escalation, where users can access resources belonging to other users or system-level files. Patches in versions 6.5 and 5.21.4 introduce robust input validation and path normalization routines to prevent such traversals.
Platform: Canonical LXD LXD-UI
Version: Before 6.5 5.21.4
Vulnerability: Path Traversal
Severity: MEDIUM
Date: 2025-10-02
Prediction: Patch 6.5 5.21.4
What Undercode Say:
Analytics:
curl -k “https://
lxc query -X GET /1.0/containers/../..
grep -r “os.path.join” /usr/share/lxd-ui/
Vulnerable code snippet
def serve_resource(name):
path = os.path.join(BASE_DIR, name)
return open(path).read()
How Exploit:
- Authenticate to LXD-UI.
- Inject traversal sequences.
- Request unauthorized resources.
Protection from this CVE:
- Update to patched versions.
- Validate and sanitize input.
- Implement path normalization.
Impact:
- Sensitive file disclosure.
- Unauthorized data modification.
- Host integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
