CVE-2026-25077

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25077

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25077.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25077

Published

2026-05-08T12:21:27.034Z

Modified

2026-07-08T07:57:08.467326038Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

Details

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack.

Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-94"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.11.0"
                },
                {
                    "last_affected": "4.20.2.0"
                },
                {
                    "introduced": "4.21.0.0"
                },
                {
                    "last_affected": "4.22.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25077.json"
}

References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type

GIT

Repo

https://github.com/apache/cloudstack

Events

Introduced

5dada1f7ed5fb6a8ee261c763f744583e586f8bf

Fixed

c8599040b4756034c7105806a53d2c99eb7ea0fe

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.11.0.0"
        },
        {
            "fixed": "4.20.3.0"
        }
    ],
    "cpe": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25077.json"