Executive brief
Apache CloudStack, an open-source platform for managing large networks of virtual machines, contains a vulnerability in how it handles virtual machine templates. An authorized user can upload a specially crafted template that allows them to execute unauthorized commands on the underlying physical servers (KVM hosts). This could lead to a total compromise of the cloud infrastructure, including data theft, service outages, and unauthorized access to other customers' virtual environments.
Technical details
A command injection vulnerability exists in Apache CloudStack's 'Direct Download' template registration feature for KVM hypervisors. The root cause is a failure to sanitize filenames when templates are registered to be downloaded directly to primary storage. An attacker with standard account access can register a malicious template with a crafted filename to achieve arbitrary code execution on the KVM hosts. This bypasses isolation between the management layer and the physical infrastructure, potentially leading to full host compromise. The issue is resolved in versions 4.20.3.0 and 4.22.0.1.
Affected products
- Apache CloudStack 4.11.0.0 through 4.20.2.0, 4.21.0.0 through 4.22.0.0
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched