CVE-2025-53513: Zip slip vulnerability in Juju

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-08 · updated 2026-06-17
Weakness: CWE-24

Description

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.

Affected products

Canonical Juju: before 2.9.52; from 3.0 before 3.6.8 — fixed in 2.9.52, 3.6.8

How to fix

Upgrade to a fixed version: Canonical Juju 2.9.52, 3.6.8. Check the vendor advisory for mitigations.

References

https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8
https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8

Get alerted when CVE-2025-53513 or the next vulnerability affects your stack