Łukasz Bawolski

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.15.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** Improper access control in the annotation functionality allows authenticated users to create and disclose comments without authorization. The 'addAnnotation' and 'listAnnotation' APIs perform an ownership check when an entity's UUID is specified but do not correctly honor the result. Consequently, any authenticated user can write annotations to or view existing annotations on an entity they do not own by providing its `UUID`. **Recommendations** Upgrade versions 4.15.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** An OS Command Injection issue exists in the NAS backup provider plugin. The 'addBackupRepository' and 'updateBackupRepository' API endpoints accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when a backup restore is performed by any account. **Recommendations** Upgrade versions 4.20.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.14.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist. **Recommendations** For versions 4.14.0.0 through 4.20.3.0, upgrade to version 4.20.3.1 or later. For versions 4.21.0.0 through 4.22.1.0, upgrade to version 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.2.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP providers. Any user with access to the 'listLdapConfigurations' API, which is available to all default roles by default, can list LDAP configurations. **Recommendations** Upgrade versions 4.2.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.15.1.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** Improper encoding or escaping of output in the user interface occurs when using the Instance Reset Password functionality. This leads to a Cross-Site Scripting (XSS) issue, where malicious scripts can be injected into web pages viewed by other users. **Recommendations** Upgrade Apache CloudStack versions 4.15.1.0 through 4.20.3.0 to version 4.20.3.1 or later. Upgrade Apache CloudStack versions 4.21.0.0 through 4.22.1.0 to version 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** Command Injection occurs in the run and get diagnostics functionality for system VMs and virtual routers. An authenticated user with necessary permissions can execute arbitrary commands on system VM and Virtual Router instances, running as root or the diagnostics-process user. This can lead to a full compromise of the instance and potentially allow lateral movement within the managed infrastructure, including access to guest network traffic. The affected API endpoints are `getDiagnosticsData` and `runDiagnostics`, which are restricted to Admin role accounts by default. **Recommendations** Upgrade versions 4.20.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later. Restrict access to the `getDiagnosticsData` and `runDiagnostics` API endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** An issue in the Webhook module allows the exposure of sensitive information to unauthorized actors during the process of listing and deleting deliveries. **Recommendations** Upgrade versions 4.20.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** KG-5260xxxx-IL-(G)2 versions prior to 2026-04-23 Kenik Camera management Panel versions prior to 2025-04-21 **Description** The Kenik Camera management Panel is affected by a path traversal issue. This allows an unauthenticated attacker to send a GET request containing an arbitrary file path to read files stored on the server. Path traversal is a flaw that allows attackers to access files and directories that are stored outside the web root folder. **Recommendations** Update KG-5260xxxx-IL-(G)2 to version 2026-04-23. Update Kenik Camera management Panel to version 2025-04-21.