Authorization Bypass in Juju Controller Allowing Malicious Charm Uploads

CVE-2025-53513

What is CVE-2025-53513?

The /charms endpoint of the Juju controller has been found lacking proper authorization controls, enabling any authenticated user to upload arbitrary charms. This flaw permits an attacker to exploit the system by introducing malicious charms that take advantage of a Zip Slip vulnerability. Such an attack could potentially grant unauthorized access to the underlying machines running units linked to the compromised charm, leading to severe security risks.

References