---
id: CVE-2025-54290
title: >-
  Information disclosure in image export API in Canonical LXD before 6.5 and
  5.21.4 on Linux allows network attackers to determine project existence
  without authentication via crafted requests using wildcard fingerprints.
summary: >-
  Information disclosure in image export API in Canonical LXD before 6.5 and
  5.21.4 on Linux allows network attackers to determine project existence
  without authentication via crafted requests using wildcard fingerprints.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
vendor: canonical
product: lxd
affected:
  - 'lxd >= 4.0.0, < 5.21.4'
  - 'lxd >= 6.1, < 6.5'
patched:
  - lxd 6.5
published: '2025-10-02'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-54290'
references:
  - url: 'https://github.com/canonical/lxd/security/advisories/GHSA-p3x5-mvmp-5f35'
    label: security@ubuntu.com
tags:
  - nvd
epss: 0.00337
epssPercentile: 0.25137
ingestedAt: '2026-10-12T15:55:08.073Z'
---

## Overview

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

## Affected

- `lxd >= 4.0.0, < 5.21.4`
- `lxd >= 6.1, < 6.5`

## Remediation

Upgrade past the affected range:

- `lxd 6.5`