Ubuntu CVE-2025-54287

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attack

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attacker

Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an

Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify wheth

Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvid

Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write

Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated

Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted proj

Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authentica

Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privile