Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3 Exploit, Vendor Advisory
- https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.8 · canonicalNVD modified 2026-10-12 15:10
Affected (CPE criteria) 1
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*
References 2
- https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3 Exploit, Vendor Advisory
- https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3 Exploit, Vendor Advisory