A critical path traversal vulnerability in Canonical Juju allows authenticated users to achieve remote code execution on units by uploading malicious charms.

The /charms endpoint lacks proper authorization and input validation, permitting an authenticated user to perform a path traversal attack. By uploading a crafted charm that exploits a Zip Slip vulnerability, an attacker can overwrite files and gain unauthorized access to machines running the affected unit.

This vulnerability poses a significant risk to infrastructure integrity, as it allows any authenticated user to escalate privileges and execute code on target machines. Given the CVSS score of 8.8, this flaw represents a high risk for environments relying on Juju for service orchestration, potentially resulting in full system compromise and lateral movement within the containerized or cloud environment.

Immediate Action: Upgrade Juju to the patched versions provided by Canonical or the specific Go module version 0.0.0-20250619215741-6356e984b82a to remediate the endpoint flaw.

Proactive Monitoring: Review Juju controller access logs for unauthorized or suspicious charm uploads, particularly those originating from accounts that do not typically perform administrative or deployment tasks.

Compensating Controls: Implement strict Role Based Access Control (RBAC) to limit the number of users capable of uploading charms to the controller until patches are verified and applied.

Public Exploit Available: Unknown.

The risk associated with this vulnerability is high due to the potential for remote code execution. Security teams should prioritize patching the Juju controller immediately and restricting upload permissions to essential personnel only. Failure to address this flaw could lead to a total compromise of managed units within the Juju environment.