The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.

Affected: Go: github.com/juju/juju

### Impact

Any user with a Juju account on a controller can upload a charm to the /charms endpoint. No specific permissions are required - it's just sufficient for the user to exist in the controller user database. A charm which exploits the zip slip vulnerability may be used to allow such a user to get access to a machine running a unit using the affected charm.

### Details

A controller exposes three charm-related HTTP API endpoints, as follows: - PUT/GET https://<controller-ip>:17070/model-<model-uuid>/charms/<nameofcharm>-<hashofcharm> - POST/GET https://<controller-ip>:17070/model-<model-uuid>/charms - GET https://<controller-ip>:17070/charms

These endpoints require Basic HTTP authentication credentials and will accept any valid user within the context of the controller. A user that has no specific permission or access granted can call all of these APIs.

To reproduce:

``` juju bootstrap juju add-user testuser juju change-user-password testuser ```

Download the ZIP file of an arbitrary charm eg [https://github.com/juju/hello-juju-charm](https://github.com/juju/hello-juju-charm)

Download and install the following tool: [https://github.com/usdAG/slipit](https://github.com/usdAG/slipit)

Run the following command to generate a new SSH key pair: `ssh-keygen`

Copy the contents of the newly created public key into a file called `authorized_keys`

Run the following command to inject the malicious path into the ZIP file: ``` slipit hello.zip authorized_keys --separator .…

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media