CVE-2025-54287 — Arbitrary File Read via Template Injection in Snapshot Patterns
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the h…
Published: 2025-10-02 · CVSS: 7.1 · CVSS 4.0
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7