Missing file name sanitization during template registration allows an attacker to register a malicious template that, when deployed, injects arbitrary commands into the KVM hypervisor. This flaw enables the attacker to execute code on the underlying host, thereby compromising resource integrity, confidentiality, causing data loss, denial of service, and disrupting the availability of the KVM‑based environment.

Apache CloudStack releases prior to 4.20.3.0 or 4.22.0.1, which still permit user‑initiated template registration for KVM deployments.

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% shows a very low probability of exploitation and the flaw is not listed in the CISA KEV catalog. The likely attack is via the CloudStack web UI or API, where any user with template‑registration privileges can submit a malicious file name. Upon deployment, the injected commands run on the hypervisor, allowing full control of the host and the entire infrastructure.