CVE Explorer

CVE-2026-25077

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3bfa80de230c23e90b6623883f0933233b9f63f26823742839806158f40ea59b

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Apache CloudStack","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.20.2.0","status":"affected","version":"4.11.0","versionType":"semver"},{"lessThanOrEqual":"4.22.0.0","status":"affected","version":"4.21.0.0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b4f3bfcf5c7b44e4e04a091b02ca551b446efe70c9f01a6e72ce888941ab1190 · sha256:9a9f8916c77ef9e8… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:b4f3bfcf5c7b44e4e04a091b02ca551b446efe70c9f01a6e72ce888941ab1190 · sha256:9a9f8916c77ef9e8… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:b4f3bfcf5c7b44e4e04a091b02ca551b446efe70c9f01a6e72ce888941ab1190 · sha256:9a9f8916c77ef9e8… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"http://www.openwall.com/lists/oss-security/2026/05/09/6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b4f3bfcf5c7b44e4e04a091b02ca551b446efe70c9f01a6e72ce888941ab1190 · sha256:9a9f8916c77ef9e8… · /containers/adp/1/references/0

{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b4f3bfcf5c7b44e4e04a091b02ca551b446efe70c9f01a6e72ce888941ab1190 · sha256:9a9f8916c77ef9e8… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer