Go/github.com/juju/juju CVE-2025-53513: high 8.8, EPSS 0.78%

Juju zip slip vulnerability via authenticated endpoint

Action: Upgrade github.com/juju/juju to 0.0.0-20250619215741-6356e984b82a or later.

go get github.com/juju/juju@v0.0.0-20250619215741-6356e984b82a

Affected

Fixed versions

Sources

• osv: GHSA-24ch-w38v-xmh8
• https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8
• https://nvd.nist.gov/vuln/detail/CVE-2025-53513
• https://github.com/juju/juju/commit/6356e984b82a4a7b9771ff5e51e297ad62f3b405
• https://github.com/juju/juju/commit/ff39557a137c0e95d4cd3553b0f19c859c6f5d8e
• https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view
• https://github.com/juju/juju
• https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L754
• https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L897
• https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L990
• https://pkg.go.dev/vuln/GO-2025-3804

CVE-2025-53513 · published 2025-07-09T15:29:03Z · modified 2026-07-08T07:14:03.650470926Z · JSON