Samy Ghannad

An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist.

URLs are not correctly escaped within the `content` attribute of a `<meta>` tag. If the URL content contains ASCII whitespaces around the `=` rune, the escaper fails to process it correctly, which can lead to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites.