What is the CVSS score of CVE-2025-54293?

CVE-2025-54293 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2025-54293?

CVE-2025-54293 presents notable security risk, a path traversal vulnerability rated CVSS 6.5. This could allow unauthorized file access. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2025-54293?

Yes, a public proof-of-concept exploit is available for CVE-2025-54293. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-54293?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Ubuntu CVE-2025-54293

EUVD-2025-32640 MEDIUM

Path Traversal (CWE-22)

2025-10-02 security@ubuntu.com

GHSA-472f-vmf2-pr3h

Path Traversal Ubuntu Debian Lxd Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Ubuntu

MEDIUM

qualitative

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 19:12 euvd

EUVD-2025-32640

Analysis Generated

Mar 13, 2026 - 19:12 vuln.today

PoC Detected

Dec 10, 2025 - 19:31 vuln.today

Public exploit code

CVE Published

Oct 02, 2025 - 11:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.

Analysis

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More in Lxd

View all

CVE-2025-54286 HIGH This Week POC

8.8 Oct 02

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s

CVE-2025-54289 HIGH This Week POC

8.1 Oct 02

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions

CVE-2025-54288 MEDIUM This Month POC

6.8 Oct 02

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attack

CVE-2025-54287 MEDIUM This Month POC

6.5 Oct 02

A arbitrary file access vulnerability (CVSS 6.5) that allows an attacker with instance configuration permissions. Risk

CVE-2026-12411 CRITICAL Act Now

9.6 Jun 26

Cross-guest storage-volume hijacking in Canonical LXD 6.6 through 6.8 lets an untrusted guest instance mount, read, and

CVE-2025-54290 MEDIUM This Month POC

5.3 Oct 02

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to d

CVE-2025-54291 MEDIUM This Month POC

5.3 Oct 02

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remo

CVE-2025-54292 MEDIUM This Month POC

4.6 Oct 02

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attac

CVE-2026-3351 MEDIUM This Month POC

4.3 Mar 03

Canonical LXD 6.6 on Linux contains an authorization bypass in the GET /1.0/certificates API endpoint that allows authen

CVE-2024-6219 LOW Monitor POC

3.8 Dec 06

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust

CVE-2024-6156 LOW Monitor POC

3.8 Dec 06

Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was prese

CVE-2026-9640 HIGH This Week

7.2 Jun 26

Privilege escalation in Canonical LXD (versions 6.0-6.8, 5.21.0-5.21.4, and 5.0.0-5.0.6) allows an authenticated project

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

CVE-2018-13379 CRITICAL POC

9.1

CVE-2015-0016 HIGH POC

7.8

Same technique Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2016-0752 HIGH POC

7.5

CVE-2024-13159 CRITICAL POC

9.8

CVE-2024-13160 CRITICAL POC

9.8

CVE-2024-13161 CRITICAL POC

9.8

CVE-2014-0780 CRITICAL POC

9.8

CVE-2024-48248 HIGH POC

8.6

Vendor StatusVendor

Ubuntu

Priority: Medium

lxd

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
jammy	DNE	-
noble	DNE	-
plucky	DNE	-
upstream	needs-triage	-
questing	DNE	-

Debian

incus

Release	Status	Fixed Version	Urgency
trixie	fixed	6.0.4-2+deb13u1	-
trixie (security)	fixed	6.0.4-2+deb13u4	-
forky, sid	fixed	6.0.5-8	-
(unstable)	fixed	6.0.5-1	-

lxd

Release	Status	Fixed Version	Urgency
bookworm	fixed	5.0.2-5+deb12u1	-
bookworm (security)	fixed	5.0.2-5+deb12u3	-
trixie	fixed	5.0.2+git20231211.1364ae4-9+deb13u1	-
trixie (security)	fixed	5.0.2+git20231211.1364ae4-9+deb13u3	-
(unstable)	fixed	(unfixed)	-

DSA-6027-1 DSA-6028-1

SUSE

Severity: Medium

Product	Status
openSUSE Tumbleweed	Fixed

CVE-2025-54293 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-54293

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Lxd

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code