Medium
Project Existence Disclosure via Error Handling in LXD Image Export
Type: advisorySources: OSV
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-54290
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 10:54 UTC · Revision 1
Source evidence
Project Existence Disclosure via Error Handling in LXD Image Export
core-osv · Original sourcePublished 2 Oct 2025, 09:24 UTC
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
osv:CVE-2025-54290
Complete source record
{
"id": "f2d351c800b64e90b27ccf01ffcc33ba927769fa3bdda08e65dfafba1ebb6a97",
"url": "https://osv.dev/vulnerability/CVE-2025-54290",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Project Existence Disclosure via Error Handling in LXD Image Export",
"summary": "Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.",
"evidence": "osv:CVE-2025-54290",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-54290",
"aliases": [
"CVE-2025-54290",
"GHSA-p3x5-mvmp-5f35",
"GO-2025-4002"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/canonical/lxd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fec3cc832ca782d398c82d38f8532ef9d5be2e00"
},
{
"introduced": "761d134ceabd306f57acfb0ca51f59b03751a5b0"
},
{
"fixed": "0494f5d47e41af69a8374568c0cb8b3eefd72a6a"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"fixed": "6.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "5.21"
},
{
"fixed": "5.21.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"lxd-5.17",
"lxd-5.16",
"lxd-5.15",
"lxd-5.14",
"lxd-5.13",
"lxd-5.12",
"lxd-5.11",
"lxd-5.10",
"lxd-5.9",
"lxd-5.8",
"lxd-5.7",
"lxd-5.6",
"lxd-5.5",
"lxd-5.4",
"lxd-5.3",
"lxd-5.2",
"lxd-5.1",
"lxd-5.0.0",
"lxd-4.24",
"lxd-4.23",
"lxd-4.22",
"lxd-4.21",
"lxd-4.20",
"lxd-4.19",
"lxd-4.18",
"lxd-4.17",
"lxd-4.16",
"lxd-4.15",
"lxd-4.14",
"lxd-4.13",
"lxd-4.12",
"lxd-4.11",
"lxd-4.10",
"lxd-4.9",
"lxd-4.8",
"lxd-4.7",
"lxd-4.6",
"lxd-4.5",
"lxd-4.4",
"lxd-4.3",
"lxd-4.2",
"lxd-4.1",
"lxd-4.0.0",
"lxd-3.23",
"lxd-3.22",
"lxd-3.21",
"lxd-3.20",
"lxd-3.19",
"lxd-3.18",
"lxd-3.17",
"lxd-3.16",
"lxd-3.15",
"lxd-3.14",
"lxd-3.13",
"lxd-3.12",
"lxd-3.11",
"lxd-3.10",
"lxd-3.9",
"lxd-3.8",
"lxd-3.7",
"lxd-3.6",
"lxd-3.5",
"lxd-3.4",
"lxd-3.3",
"lxd-3.2",
"lxd-3.1",
"lxd-3.0.0",
"lxd-3.0.0.beta7",
"lxd-3.0.0.beta6",
"lxd-3.0.0.beta5",
"lxd-3.0.0.beta4",
"lxd-3.0.0.beta3",
"lxd-3.0.0.beta2",
"lxd-3.0.0.beta1",
"lxd-2.21",
"lxd-2.20",
"lxd-2.19",
"lxd-2.18",
"lxd-2.17",
"lxd-2.16",
"lxd-2.15",
"lxd-2.14",
"lxd-2.13",
"lxd-2.12",
"lxd-2.11",
"lxd-2.10.1",
"lxd-2.10",
"lxd-2.9.3",
"lxd-2.9.2",
"lxd-2.9.1",
"lxd-2.9",
"lxd-2.8",
"lxd-2.7",
"lxd-2.6.2",
"lxd-2.6.1",
"lxd-2.6",
"lxd-2.5",
"lxd-2.4.1",
"lxd-2.4",
"lxd-2.3",
"lxd-2.2",
"lxd-2.1",
"lxd-2.0.0",
"lxd-2.0.0.rc9",
"lxd-2.0.0.rc8",
"lxd-2.0.0.rc7",
"lxd-2.0.0.rc6",
"lxd-2.0.0.rc5",
"lxd-2.0.0.rc4",
"lxd-2.0.0.rc3",
"lxd-2.0.0.rc2",
"lxd-2.0.0.rc1",
"lxd-2.0.0.beta4",
"lxd-2.0.0.beta3",
"lxd-2.0.0.beta2",
"lxd-2.0.0.beta1",
"lxd-0.27",
"lxd-0.26",
"lxd-0.25",
"lxd-0.24",
"lxd-0.23",
"lxd-0.22",
"lxd-0.21",
"lxd-0.20",
"lxd-0.19",
"lxd-0.18",
"lxd-0.17",
"lxd-0.16",
"lxd-0.15",
"lxd-0.14",
"lxd-0.13",
"lxd-0.12",
"lxd-0.11",
"lxd-0.10",
"lxd-0.9",
"lxd-0.8.1",
"lxd-0.8",
"lxd-0.7",
"lxd-0.6",
"lxd-0.5",
"lxd-0.4",
"lxd-0.3",
"lxd-0.2",
"lxd-0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54290.json"
}
}
],
"modified": "2026-10-28T02:30:28.019186157Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54290.json",
"https://github.com/canonical/lxd/security/advisories/GHSA-p3x5-mvmp-5f35",
"https://nvd.nist.gov/vuln/detail/CVE-2025-54290",
"https://github.com/canonical/lxd"
],
"provider_metadata": {
"cwe_ids": [
"CWE-200"
],
"cna_assigner": "canonical",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54290.json"
}
},
"related_cves": [
{
"value": "CVE-2025-54290",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 494743,
"published_at": "2025-10-02T09:24:12.894+00:00"
}