Medium severity5.3NVD Advisory· Published Oct 2, 2025· Updated Jun 17, 2026
CVE-2025-54291
CVE-2025-54291
Description
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/canonical/lxdGo | >= 4.0, < 5.21.4 | 5.21.4 |
github.com/canonical/lxdGo | >= 6.0, < 6.5 | 6.5 |
github.com/canonical/lxdGo | >= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41 | 0.0.0-20250827065555-0494f5d47e41 |
Affected products
5- ghsa-coords3 versionspkg:golang/github.com/canonical/lxdpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
>= 4.0, < 5.21.4+ 2 more
- (no CPE)range: >= 4.0, < 5.21.4
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 0.0.20251105T184115-1.1
Patches
Vulnerability mechanics
References
4- github.com/canonical/lxd/security/advisories/GHSA-xch9-h8qw-85c7nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-xch9-h8qw-85c7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-54291ghsaADVISORY
- pkg.go.dev/vuln/GO-2025-4005ghsaWEB
News mentions
0No linked articles in our index yet.