CVE-2026-25077

Apache CloudStack is vulnerable to an unauthenticated command injection due to missing file name sanitization when users register templates for direct download to primary storage for KVM hypervisor deployments. An attacker can register malicious templates to execute arbitrary code on KVM hosts, p...