Template Injection Vulnerability in Canonical LXD Instance Snapshot Feature

CVE-2025-54287

What is CVE-2025-54287?

A vulnerability has been identified in the instance snapshot creation component of Canonical LXD (version 4.0 and higher), which utilizes the Pongo2 template engine. This flaw permits an attacker, granted instance configuration permissions, to leverage specially crafted snapshot pattern templates. By exploiting this vulnerability, the attacker can gain unauthorized access to arbitrary files located on the host system, posing serious security risks.

References