CVE-2025-54293: Canonical LXD Path Traversal Vulnerability

CVE-2025-54293 Overview

CVE-2025-54293 is a path traversal vulnerability [CWE-22] in the log file retrieval function of Canonical LXD 5.0 LTS on Linux. Authenticated remote attackers can read arbitrary files on the host system by supplying crafted log file names or leveraging symbolic links. The flaw allows access to sensitive data outside the intended log directory, breaching the isolation boundary between the LXD management interface and the underlying host filesystem.

Critical Impact
Authenticated attackers can read arbitrary host files through the LXD API, exposing configuration files, credentials, and other sensitive data on systems running Canonical LXD 5.0 LTS.

Affected Products

Canonical LXD 5.0 LTS
Linux hosts running affected LXD versions
Deployments exposing the LXD API to authenticated remote clients

Discovery Timeline

2025-10-02 - CVE-2025-54293 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54293

Vulnerability Analysis

The vulnerability resides in the LXD log file retrieval function. The function accepts a log file name from an authenticated client but fails to properly validate or canonicalize the supplied path. Attackers can submit path traversal sequences or place symbolic links inside the expected log directory to escape the intended scope. Successful exploitation returns the contents of arbitrary files that the LXD service can read on the host.

Because the LXD daemon typically runs with elevated privileges, the accessible file set can include system configuration files, credential material, and files owned by other containers or workloads managed by the host. The confidentiality impact is high, while integrity and availability remain unchanged.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The log retrieval routine trusts client-supplied file identifiers without enforcing a canonicalized boundary or rejecting symbolic links that resolve outside the logs directory. This is a classic CWE-22 pattern where filename normalization occurs before link resolution.

Attack Vector

Exploitation requires network access to the LXD API and a valid authenticated session with sufficient privileges to invoke log retrieval. The attacker crafts a request referencing a log file name containing traversal sequences, or first places a symbolic link inside the log directory pointing to a target file. The server then reads and returns the linked file's contents. Refer to the Canonical LXD GitHub Security Advisory GHSA-472f-vmf2-pr3h for vendor-supplied technical detail.

Detection Methods for CVE-2025-54293

Indicators of Compromise

LXD API log retrieval requests containing traversal sequences such as ../ or absolute paths outside the expected logs directory
Symbolic links present inside container or instance log directories that resolve to files outside /var/log/lxd/ or /var/snap/lxd/common/lxd/logs/
Unexpected reads of sensitive host files such as /etc/shadow, /root/.ssh/, or LXD configuration files performed by the lxd process

Detection Strategies

Review LXD access logs for GET requests to log-retrieval endpoints referencing unusual file names or path components
Audit the log directories on LXD hosts for symbolic links that do not correspond to legitimate instance or daemon logs
Correlate authenticated API activity with file access telemetry to identify reads outside expected log paths

Monitoring Recommendations

Enable auditd rules on LXD hosts to record file reads performed by the lxd daemon against sensitive paths
Forward LXD API and system audit logs to a centralized analytics platform for retention and query
Alert on any successful log retrieval response whose byte size or content type deviates from normal LXD log output

How to Mitigate CVE-2025-54293

Immediate Actions Required

Upgrade Canonical LXD 5.0 LTS to the patched release identified in the Canonical LXD GitHub Security Advisory GHSA-472f-vmf2-pr3h
Restrict LXD API exposure to trusted management networks and remove any unnecessary remote client certificates
Rotate credentials or secrets that may have been readable through the LXD service account on affected hosts

Patch Information

Canonical has published a fix through the LXD project. Apply the update referenced in advisory GHSA-472f-vmf2-pr3h on every affected host. Snap-based installations should refresh the lxd snap to a version at or above the fixed release, and distribution package users should install the vendor-provided update.

Workarounds

Limit LXD API access to administrators only and remove low-privilege client trust entries until patching is complete
Disable remote HTTPS listeners on the LXD daemon where remote management is not required
Periodically inspect and remove unexpected symbolic links inside LXD log directories

bash

# Refresh the LXD snap and disable remote API exposure until patched
sudo snap refresh lxd
lxc config unset core.https_address
lxc config trust list