Authorization Bypass in Juju Controller Allowing Malicious Charm Uploads
CVE-2025-53513

8.8HIGH

Key Information:

Vendor

Canonical

Status
Vendor
CVE Published:
8 July 2025

What is CVE-2025-53513?

The /charms endpoint of the Juju controller has been found lacking proper authorization controls, enabling any authenticated user to upload arbitrary charms. This flaw permits an attacker to exploit the system by introducing malicious charms that take advantage of a Zip Slip vulnerability. Such an attack could potentially grant unauthorized access to the underlying machines running units linked to the compromised charm, leading to severe security risks.

Affected Version(s)

Juju Linux 2.0.0 < 2.9.52

Juju Linux 3.0.0 < 3.6.8

References

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53513 : Authorization Bypass in Juju Controller Allowing Malicious Charm Uploads