CVE-2026-25077: Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-08 · updated 2026-10-26
Weakness: CWE-94

Description

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Affected products

Apache Software Foundation Apache CloudStack: from 4.11.0.0 before 4.20.3.0; from 4.21.0.0 before 4.22.0.1 — fixed in 4.20.3.0, 4.22.0.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CloudStack 4.20.3.0, 4.22.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-25077 or the next vulnerability affects your stack