Vulnerability · Published Jul 8, 2025 · Assigned by canonical
CVE-2025-0928Arbitrary executable upload via authenticated endpoint
High 8.8
In plain English
A high-severity security flaw in Juju from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/juju/juju | 0.0.0-20250619215741-4034aa13c7cf | GHSA-4vc8-wvhw-m5gv |
| Go | github.com/juju/juju | no fix listed | GO-2025-3805 |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H