Canonical LXD-UI EUVD-2025-33223

Exploitation requires the attacker to first hold valid authenticated access to the LXD-UI web interface (PR:L), and some active user interaction is indicated by the vendor vector (UI:A). The attack vector is the LXD-UI feature that resolves resource names supplied in URL paths: the attacker must be able to submit crafted resource names containing traversal sequences through that UI. Limiting factors: this is not a pre-authentication flaw - an unauthenticated internet attacker cannot exploit it; it is confined to deployments that actually expose and use LXD-UI (the web console), not headless LXD API/CLI-only installations; and only versions before 6.5 (6.0 branch) and before 5.21.4 (5.21 branch) are affected.

This is a moderate-risk, low-priority issue despite having a publicly available exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N) scores only 4.8 (Medium): network-reachable and low-complexity, but it requires existing authenticated access (PR:L) to LXD-UI and some active user interaction (UI:A), and the vendor-assessed impact is limited to low confidentiality (VC:L) with no integrity or availability impact. Multiple real-world signals agree that this is NOT an urgent priority: EPSS is 0.04% (10th percentile, i.e. very low predicted exploitation probability), it is NOT listed in CISA KEV, and Ubuntu rates it priority=medium. The only elevated signal is public POC availability (from the Canonical GHSA advisory), but POC existence is distinct from active exploitation and the extremely low EPSS plus absence of KEV indicate no observed in-the-wild activity. One notable conflict: the description states the flaw allows attackers to 'access or modify unintended resources' (implying an integrity impact), yet the vendor CVSS vector sets VI:N (no integrity impact) - this discrepancy should be verified with Canonical, as either the vector understates integrity or the 'modify' wording is broader than the scored impact. No SSVC decision was provided in the input. Net: a genuine but low-severity, post-authentication information-disclosure/path-traversal bug - patch during normal maintenance, not an emergency.

An attacker who already holds valid (even low-privileged) credentials to the LXD-UI web console crafts a resource name containing path-traversal sequences and embeds it in a URL path, causing the UI backend to resolve a resource outside its intended scope. A public exploit reference exists via the Canonical GHSA-7425-4qpj-v4w3 advisory, and the low attack complexity (AC:L) makes the request trivial to construct once authenticated.