The vulnerability allows an authenticated tenant to embed an attacker‑controlled metalink file or NFS reference that the CloudStack infrastructure will process without proper validation. Because the metalink XML can contain arbitrary URLs, the secondary storage VM retrieves the data, stores it as a template, and an API download of that template can be performed later. When a user registers a VM template with directDownload enabled and a URL pointing to a metalink file, the management server downloads the XML and then delegates the fetch to the KVM agent. The agent satisfies the inner URLs present in the metalink without applying the normal scheme allowlist, permitting connections to internal systems and leading to remote code execution on the KVM hypervisor host. This provides cross‑tenant root access to the compute node that hosts other tenants' virtual machines, effectively breaking tenant isolation. The weakness is characterized by two common weaknesses: operating system command injection (CWE-78) and server‑side request forgery (CWE-918), which together allow an authorized user with default privileges to execute commands on the hypervisor. Affected versions of Apache CloudStack range from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The public CloudStack API is the likely attack vector because the vulnerability requires authenticated access but can be exercised through the normal management API.

Apache Software Foundation’s Apache CloudStack product is impacted. All installations running any of the affected releases – from 4.14.0.0 to 4.20.3.0 inclusive, and from 4.21.0.0 to 4.22.1.0 inclusive – are vulnerable. The root-of-trust is the KVM hypervisor that hosts tenant VMs.

The vulnerability is graded as high severity (CVSS 8.8); exploitation yields root access on the host. The EPSS score is 0.00172, yet the nature of the flaw suggests a significant likelihood of exploitation in a cloud environment. The vulnerability is not currently listed in the CISA KEV catalog, but the nexus between client‑controlled metalink files and the server’s direct download path creates a straightforward exploitation scenario via the public CloudStack API. An attacker with valid API credentials and a default user role can craft a template that points to a malicious metalink or NFS source, causing the management server to relay the request to the hypervisor agent without validation, which then executes commands as root.