CVE-2025-53513: Canonical Juju

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.

Affected products

• Canonical Juju: before 2.9.52 (fixed in 2.9.52); from 3.0, before 3.6.8 (fixed in 3.6.8)

Published 2025-07-08. Last modified 2026-06-17.