{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "cveMetadata": {
    "cveId": "MOKSHA-2026-0039",
    "assignerOrgId": "moksha.dk",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned.",
    "state": "PUBLISHED",
    "datePublished": "2026-04-24T06:00:00Z",
    "alternateIds": [
      "GCVE-117-2026-0039"
    ],
    "x_moksha_semantic_id": "SSMC-4"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "moksha.dk",
        "shortName": "Moksha",
        "dateUpdated": "2026-04-24T06:00:00Z"
      },
      "title": "Filesystem Layout Manipulation via SR.sm_config nosubdir/subdir",
      "descriptions": [
        {
          "lang": "en",
          "value": "A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can manipulate the filesystem layout of NFS and MooseFS storage repositories by modifying the nosubdir or subdir key in SR.sm_config after SR creation. Changing nosubdir causes the driver to look for VDIs in the wrong directory. All VDIs appear missing, causing VM boot failures and complete data inaccessibility for all VMs on the affected SR. The attack is reversible but causes service disruption."
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
            "baseScore": 8.5,
            "baseSeverity": "HIGH"
          }
        },
        {
          "format": "CVSS",
          "cvssV4_0": {
            "version": "4.0",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
            "baseScore": 8.7,
            "baseSeverity": "HIGH"
          }
        }
      ],
      "affected": [
        {
          "vendor": "Cloud Software Group",
          "product": "XenServer",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Vates",
          "product": "XCP-ng",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Missing Authorization",
              "cweId": "CWE-862",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Improper Input Validation",
              "cweId": "CWE-20",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://gna.moksha.dk/MOKSHA-2026-0039"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ]
    }
  },
  "x_gcve": [
    {
      "vulnId": "GCVE-117-2026-0039",
      "recordType": "advisory",
      "relationships": [
        {
          "destId": "MOKSHA-2026-0039",
          "type": "equal"
        }
      ]
    }
  ]
}