VULNERABILITY INTELLIGENCE

CVE-2025-53513

CVSS score8.8 HIGH
EPSS probability0.78%
CISA KEVNot currently listed
Published2025-07-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.

Weakness classification

  • security@ubuntu.com: CWE-24
  • nvd@nist.gov: CWE-22

Primary references