CVE-2026-50112

Apache CloudStack (4.14.0.0–4.20.3.0 and 4.21.0.0–4.22.1.0) is affected by two linked issues in its template registration flow. When a tenant registers a VM template with directDownload=true pointing to a .metalink file, the management server fetches the metalink XML and dispatches the download t...