HIGH🇵🇱 Wersja polska

CVE-2025-53513

CVSS 8.8v3.1pub. 2025-07-08upd. 2026-01-08

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Canonical Juju

    APP
    Canonical
    < 2.9.523.0 – 3.6.8 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2026-5412CRITICAL9.9PL ✓same product

Canonical Juju — nieuprawniony dostęp do poświadczeń chmury przez Controller facade

CVE-2026-4370CRITICAL10.0PL ✓same product

Canonical Juju: brak uwierzytelnienia TLS w klastrze Dqlite umożliwia przejęcie bazy danych

CVE-2017-9232CRITICAL9.8PL ✓same product

Privilege escalation w Juju przez niezabezpieczony UNIX domain socket

CVE-2025-68153HIGH7.1same product

Juju is an open source application orchestration engine that enables any application operation on any infrastr...

CVE-2026-32692HIGH7.6same product

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 thro...