GO-2025-4121
NoneCVSS
—
EPSS
—
Published
Nov 18, 2025
CISA due date
—
The record
LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/canonical/lxd | 0 | No fix |
| Go | github.com/canonical/lxd | 0 | 0.0.0-20251110144034-698854d0164f |
Related vulnerabilities
- GO-2025-4003 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in… Also affects github.com/canonical/lxd
- GO-2025-3999 Privilege Escalation via WebSocket Connection Hijacking in Operations API in… Also affects github.com/canonical/lxd
- GO-2025-4000 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in… Also affects github.com/canonical/lxd
- GO-2025-4001 Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in… Also affects github.com/canonical/lxd
- GO-2025-4005 Canonical LXD Project Existence Determination Through Error Handling in Image Get… Also affects github.com/canonical/lxd
- GO-2025-4002 Canonical LXD Project Existence Determination Through Error Handling in Image Export… Also affects github.com/canonical/lxd
- CVE-2024-6156 lxd CA certificate sign check bypass Also affects github.com/canonical/lxd
- CVE-2024-6219 lxd has a restricted TLS certificate privilege escalation when in PKI mode Also affects github.com/canonical/lxd