# CVE-2026-25077: Account users are allowed by default to register templates to be downloaded directly to the primary storage for…

Source: https://junglewise.ai/threats/cve-2026-25077-account-users-are-allowed-by-default-to-register-templates-to-be  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-25077 · Severity: high · CVSS 8.8 · Published 2026-05-08

Apache CloudStack, an open-source platform for managing large networks of virtual machines, contains a vulnerability in how it handles virtual machine templates. An authorized user can upload a specially crafted template that allows them to execute unauthorized commands on the underlying physical servers (KVM hosts). This could lead to a total compromise of the cloud infrastructure, including data theft, service outages, and unauthorized access to other customers' virtual environments.

## Quick answers

**Is CVE-2026-25077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25077 being exploited in the wild.

**How severe is CVE-2026-25077?** High severity, with a CVSS score of 8.8, published 8 May 2026.

**Which products and versions are affected?** Apache CloudStack 4.11.0.0 through 4.20.2.0, 4.21.0.0 through 4.22.0.0.

**Is there a fix for CVE-2026-25077?** A patch was published on 2026-05-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25077 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25077?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in Apache CloudStack's 'Direct Download' template registration feature for KVM hypervisors. The root cause is a failure to sanitize filenames when templates are registered to be downloaded directly to primary storage. An attacker with standard account access can register a malicious template with a crafted filename to achieve arbitrary code execution on the KVM hosts. This bypasses isolation between the management layer and the physical infrastructure, potentially leading to full host compromise. The issue is resolved in versions 4.20.3.0 and 4.22.0.1.

## Affected products

- Apache CloudStack 4.11.0.0 through 4.20.2.0, 4.21.0.0 through 4.22.0.0

## Timeline

- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched

## References

- [https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm](https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm)
- [http://www.openwall.com/lists/oss-security/2026/05/09/6](http://www.openwall.com/lists/oss-security/2026/05/09/6)