CVE-2026-25077

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/09/6

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cloudstack::::::::
	cpe:2.3:a:apache:cloudstack::::::::

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Los usuarios de cuenta tienen permitido por defecto registrar plantillas para ser descargadas directamente al almacenamiento primario para desplegar instancias utilizando el hipervisor KVM. Debido a la falta de saneamiento de nombres de archivo, un atacante puede registrar plantillas maliciosas para ejecutar código arbitrario en los hosts KVM. Esto puede resultar en el compromiso de la integridad y confidencialidad de los recursos, pérdida de datos, denegación de servicio y la disponibilidad de la infraestructura basada en KVM gestionada por CloudStack. Se recomienda a los usuarios actualizar a las versiones de Apache CloudStack 4.20.3.0 o 4.22.0.1, o posteriores, que corrige este problema.

Information

Published : 2026-05-08 13:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-25077

Mitre link : CVE-2026-25077

CVE.ORG link : CVE-2026-25077

JSON object : View

Products Affected

apache

cloudstack

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-25077", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25077", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-09T03:55:48.304766Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.11.0", "versionType": "semver", "lessThanOrEqual": "4.20.2.0"}, {"status": "affected", "version": "4.21.0.0", "versionType": "semver", "lessThanOrEqual": "4.22.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-08T13:16:36.133", "references": [{"url": "https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/09/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack.\n\n\nUsers are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue."}, {"lang": "es", "value": "Los usuarios de cuenta tienen permitido por defecto registrar plantillas para ser descargadas directamente al almacenamiento primario para desplegar instancias utilizando el hipervisor KVM. Debido a la falta de saneamiento de nombres de archivo, un atacante puede registrar plantillas maliciosas para ejecutar c\u00f3digo arbitrario en los hosts KVM. Esto puede resultar en el compromiso de la integridad y confidencialidad de los recursos, p\u00e9rdida de datos, denegaci\u00f3n de servicio y la disponibilidad de la infraestructura basada en KVM gestionada por CloudStack.\n\nSe recomienda a los usuarios actualizar a las versiones de Apache CloudStack 4.20.3.0 o 4.22.0.1, o posteriores, que corrige este problema."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B26B4D15-F80A-4383-9960-DADA4363CE29", "versionEndExcluding": "4.20.3.0", "versionStartIncluding": "4.11.0.0"}, {"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78690ED1-C4B3-4DC9-9B53-FB31D6D17125", "versionEndExcluding": "4.22.0.1", "versionStartIncluding": "4.21.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}