The flaw occurs because CloudStack makes a live HTTP HEAD/GET request to obtain the size of a template or ISO file before it validates the supplied URL. This pre‑validation step allows any authenticated user to cause the CloudStack component to perform a request to an arbitrary URI, potentially accessing internal services. The vulnerability is a classic example of CWE‑918: Server‑Side Request Forgery. Although the component does not download or register the file until after URL validation, the ability to issue internal requests can be leveraged for reconnaissance or to reach restricted endpoints.

Apache CloudStack, versions 4.20.3.0 and all releases from 4.21.0.0 through 4.22.1.0, are vulnerable. The problem is fixed in 4.20.3.1, 4.22.1.1, and all newer releases.

The CVSS score of 4.3 reflects a moderate severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and able to submit a template or ISO registration request to take advantage of the flaw. Based on the description, the likely attack vector is internal network probing; the attacker can have the CloudStack service reach internal hosts or services, but cannot store or register malicious media. The risk is primarily confidentiality and potential lateral movement within the environment, especially if compromised or rogue administrators can initiate requests.