Directory traversal vulnerability in the
virStorageBackendFileSystemVolCreate function in
storage/storage_backend_fs.c in libvirt, when fine-grained Access Control
Lists (ACL) are in effect, allows local users with storage_vol:create ACL
but not domain:write permission to write to arbitrary files via a .. (dot
dot) in a volume name.

mdeslaur