CVE-2026-25077 json
Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates
published 2026-05-08 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-28549
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack.
Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
Patch / fix
- apache cloudstack 4.20.3.0, 4.22.0.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Apache Software Foundation Apache CloudStack
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
lists.apache.org
/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm
vendor-advisory, mailing-list
- openwall.com /lists/oss-security/2026/05/09/6
Sources
- CVE List CVE-2026-25077
- NVD CVE-2026-25077
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.