Canonical LXD EUVD-2025-32636

Requires an authenticated LXD account with permission to modify instance configuration (snapshots.pattern setting), per the GHSA advisory - this is the core limiting factor. The affected feature is instance snapshot name generation, which uses the Pongo2 template engine without sandboxing (no banned tags/filters), allowing the include/ssi/extends/import tags to read host files. Exploitation also depends on scheduled or manual snapshot creation actually running so the template is rendered. It affects default configurations of vulnerable versions (LXD >=4.0, specifically 5.21<5.21.4 and 6.0<6.5.0) because no sandbox is applied out of the box. Limiting factors: requires delegated instance-config privileges (not anonymous access) and is confidentiality-only - no write, integrity, or availability impact.

This is a genuine but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly reflects a network-reachable, low-complexity attack that nonetheless requires authenticated access with instance configuration permissions (PR:L) - it is not an unauthenticated internet-facing flaw. Impact is confidentiality-only (VC:H, VI:N/VA:N): arbitrary file read as the LXD process (typically root), with no code execution demonstrated in the Pongo2 engine. Signals are mostly consistent and point toward moderate priority rather than emergency: EPSS is very low (0.06%, 19th percentile) and the vulnerability is NOT in CISA KEV, indicating no evidence of widespread automated exploitation. However, publicly available exploit code exists (the GHSA advisory includes a working payload), which raises the practical likelihood that a malicious or compromised low-privilege LXD operator could use it. The EPSS/KEV picture (low probability, not actively exploited) combined with POC availability suggests this is a privilege-boundary/insider or post-compromise escalation concern rather than a mass-exploitation threat. Net: prioritize patching for multi-tenant or delegated-permission LXD deployments where untrusted parties hold instance-config rights; lower urgency for single-admin deployments where the attacker would already be trusted.

A user granted only instance-configuration permissions in a multi-tenant LXD/LXD-UI environment sets a malicious Pongo2 template as the instance's snapshots.pattern (e.g. a payload using the include tag to read /etc/shadow or the LXD database). When a scheduled snapshot runs, the engine renders the file contents into the snapshot name, letting the low-privilege user exfiltrate host and cross-instance secrets. A working proof-of-concept payload is published in the GHSA advisory, so the attack requires no original research.