CVE-2026-25077

{
  "id": "CVE-2026-25077",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T13:16:36.133",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack.\n\n\nUsers are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue."
    },
    {
      "lang": "es",
      "value": "Los usuarios de cuenta tienen permitido por defecto registrar plantillas para ser descargadas directamente al almacenamiento primario para desplegar instancias utilizando el hipervisor KVM. Debido a la falta de saneamiento de nombres de archivo, un atacante puede registrar plantillas maliciosas para ejecutar código arbitrario en los hosts KVM. Esto puede resultar en el compromiso de la integridad y confidencialidad de los recursos, pérdida de datos, denegación de servicio y la disponibilidad de la infraestructura basada en KVM gestionada por CloudStack.\n\nSe recomienda a los usuarios actualizar a las versiones de Apache CloudStack 4.20.3.0 o 4.22.0.1, o posteriores, que corrige este problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache CloudStack",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4.11.0",
              "lessThanOrEqual": "4.20.2.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.21.0.0",
              "lessThanOrEqual": "4.22.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-09T03:55:48.304766Z",
          "id": "CVE-2026-25077",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.11.0.0",
              "versionEndExcluding": "4.20.3.0",
              "matchCriteriaId": "B26B4D15-F80A-4383-9960-DADA4363CE29"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.21.0.0",
              "versionEndExcluding": "4.22.0.1",
              "matchCriteriaId": "78690ED1-C4B3-4DC9-9B53-FB31D6D17125"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/09/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}