CVE-2025-54287: Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
Summary
CVE-2025-54287: Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns. Affects github.com/lxc/lxd across 3 version ranges.
>= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
>= 4.0, < 5.21.4
>= 6.0, < 6.5
Fixed in 0.0.0-20250827065555-0494f5d47e41, 5.21.4 or 6.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
LXD is a container and virtual machine manager that offers a user-friendly interface for managing Linux containers. It allows users to create, manage, and run containers efficiently. The software utilizes the Pongo2 template engine for generating snapshot names based on user-defined patterns. This functionality, while powerful, has introduced a security vulnerability that can be exploited to read arbitrary files from the host system.
Vulnerability Detail
The vulnerability arises from the use of the Pongo2 template engine in LXD's instance snapshot creation functionality. Specifically, the snapshots.pattern configuration can be manipulated through template injection attacks, allowing an attacker with configuration change permissions to read sensitive files from the host system. This could lead to the exposure of critical information such as LXD host configuration files, database files, and other sensitive data accessible by the LXD process.
How To Fix
Latest published version: v0.0.0-20230707070733-fa595dea7577 as of 23 Oct 2026
go get github.com/lxc/lxd@v0.0.0-20230707070733-fa595dea7577Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e410.0.0-20250827065555-0494f5d47e41go get github.com/lxc/lxd@v0.0.0-20250827065555-0494f5d47e41 -
>= 4.0, < 5.21.45.21.4go get github.com/lxc/lxd@v5.21.4 -
>= 6.0, < 6.56.5go get github.com/lxc/lxd@v6.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can modify the RenderTemplate function in shared/util.go to use a restricted TemplateSet. This can help mitigate the risk of file leakage by banning specific tags and filters that pose a risk of file reading attacks. The following tags should be banned:
- include
- ssi
- extends
- import
This can be implemented by creating a custom TemplateSet that restricts these functionalities.
Conclusion
CVE-2025-54287 represents a significant security risk for users of Canonical LXD due to its potential for arbitrary file reading through template injection. It is crucial for users to update to the latest patched versions or implement workarounds to mitigate this vulnerability.
See every vulnerability recorded for github.com/lxc/lxd →
FAQ
CVE-2025-54287 is a security vulnerability in Canonical LXD that allows arbitrary file reading through template injection in snapshot patterns.
Any user of LXD versions prior to 5.21.4 and 6.5 who has permissions to modify instance settings is potentially affected.
The risks include unauthorized access to sensitive files on the host system, such as configuration files and database files, which could lead to data leakage.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If updating is not possible, implement the suggested workaround by modifying the RenderTemplate function to restrict template functionalities that could lead to file reading.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/lxc/lxd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
