Authorization Bypass in Juju Controller Allowing Malicious Charm Uploads
CVE-2025-53513

8.8HIGH

Key Information:

Vendor

Canonical

Status
Juju
Vendor
CVE Published:
8 July 2025

What is CVE-2025-53513?

The /charms endpoint of the Juju controller has been found lacking proper authorization controls, enabling any authenticated user to upload arbitrary charms. This flaw permits an attacker to exploit the system by introducing malicious charms that take advantage of a Zip Slip vulnerability. Such an attack could potentially grant unauthorized access to the underlying machines running units linked to the compromised charm, leading to severe security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Juju Linux 2.0.0 < 2.9.52

Juju Linux 3.0.0 < 3.6.8

References

https://github.com/juju/juju/security/advisories/GHSA-24c...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.