PT-2026-38918 · Apache · Cloudstack

Reza · Published 2026-05-08 · Updated 2026-05-11 · CVE-2026-25077

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions prior to 4.20.3.0 Apache CloudStack versions prior to 4.22.0.1

Description Account users can register templates for direct download to primary storage when deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on KVM hosts. This may lead to the compromise of resource integrity and confidentiality, data loss, denial of service, and loss of availability of the KVM-based infrastructure managed by CloudStack.

Recommendations Upgrade to version 4.20.3.0 or later. Upgrade to version 4.22.0.1 or later.

Fix

DoS

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-25077

Affected Products

Cloudstack

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-25077 · Security Note
• https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/2053663130488648099 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/09/6 · Note
• https://twitter.com/VulmonFeeds/status/2052760625776824643 · Twitter Post
• https://t.me/cveNotify/162861 · Telegram Post
• https://twitter.com/CVEnew/status/2053174672984871170 · Twitter Post
• https://t.me/cveNotify/162947 · Telegram Post