CVE-2025-0928

Arbitrary executable upload via authenticated endpoint

State: Published
Severity: 8.8 High
Published: Jul 8, 2025
Updated: Jul 8, 2025
Reserved: Jan 31, 2025

Description

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	canonical

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
JujuCanonical	2.0.0 to before 2.9.52Affected 3.0.0 to before 3.6.8Affected

References

https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.