Fluid Attacks Database

Description

Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	incus	=6.0.4-2 \|\| =6.0.4-3 \|\| >=0 <6.0.5-1	6.0.5-1
debian 13	incus	=6.0.4-2 \|\| =6.0.4-2+deb13u1~bpo12+1 \|\| >=0 <6.0.4-2+deb13u1	6.0.4-2+deb13u1
debian 12	lxd	=5.0.2-5 \|\| >=0 <5.0.2-5+deb12u1	5.0.2-5+deb12u1
debian 13	lxd	=5.0.2+git20231211.1364ae4-9 \|\| >=0 <5.0.2+git20231211.1364ae4-9+deb13u1	5.0.2+git20231211.1364ae4-9+deb13u1
go	github.com/lxc/lxd/v6	-	-
go	github.com/lxc/lxd	>=4.0.0 <5.21.4 \|\| >=6.0.0 <6.5.0 \|\| >=0.0.0-20200331193331-03aab09f5b5c <0.0.0-20250827065555-0494f5d47e41	5.21.4, 6.5.0, 0.0.0-20250827065555-0494f5d47e41

Aliases

1. CVE-2025-542872. NVD-2025-542873. OSV-DEBIAN-2025-542874. OSV-2025-542875. OSV-GO-2025-40046. GHSA-w2hg-2v4p-vmh67. GCVE-2025-542878. SECURITY-TRACKER-CVE-2025-542879. GHSA-w2hg-2v4p-vmh6

References

1. https://github.com/canonical/lxd/security/advisories/GHSA-w2hg-2v4p-vmh62. https://pkg.go.dev/vuln/GO-2025-4004

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.