Directory Traversal

libvirt.so is vulnerable to directory traversals. A malicious user with storagevol:create permissions can write arbitrary files on the volume without the domain:write permission permission through the virStorageBackendFileSystemVolCreate function in storagebackendfs.c...

FreeBSD : libvirt -- ACL bypass using ../ to access beyond storage pool (f714b4c9-a6c1-11e5-88d7-047d7b492d07)

Libvit development team reports : Various virStorageVol API operate on user-supplied volume names by concatenating the volume name to the pool location. Note that the virStoragePoolListVolumes API, when used on a storage pool backed by a directory in a file system, will only list volumes...