修复了一些已知问题

backend/internal/kvm/kvm_test.go

@@ -11,6 +11,17 @@ import (
 	"golang.org/x/crypto/ssh"
 )
 
+func TestLocalImageIDRejectsPathExpressions(t *testing.T) {
+	for _, id := range []string{"", ".", "..", "../../etc/passwd", `..\\..\\windows`, "/absolute"} {
+		if got := localImageID(id); got != "__invalid_image_id__" {
+			t.Fatalf("localImageID(%q) = %q", id, got)
+		}
+	}
+	if got := localImageID("debian-13-kvm"); got != "debian-13-kvm" {
+		t.Fatalf("localImageID(valid) = %q", got)
+	}
+}
+
 func TestChpasswdStdinPreservesShellMetacharacters(t *testing.T) {
 	password := `pa'";$(touch /tmp/pwned); echo #\\word`
 	got, err := chpasswdStdin("root", password)

backend/internal/kvm/templates.go

@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	"clicd/internal/config"
 )
@@ -195,7 +196,7 @@ func ImagePath(id string) string {
 	if img != nil && img.Distro == "windows" {
 		ext = ".iso"
 	}
-	fileName := id + ext
+	fileName := localImageID(id) + ext
 	for _, pool := range config.StoragePoolsForContent(config.StorageContentImages) {
 		candidate := filepath.Join(pool.Path, "images", "kvm", fileName)
 		if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
@@ -209,6 +210,15 @@ func ImagePath(id string) string {
 	return filepath.Join(CacheDir(), fileName)
 }
 
+func localImageID(id string) string {
+	trimmed := strings.TrimSpace(id)
+	local := filepath.Base(trimmed)
+	if trimmed == "" || local == "." || local == ".." || local != trimmed || strings.ContainsAny(trimmed, `/\\`) {
+		return "__invalid_image_id__"
+	}
+	return local
+}
+
 // IsWindowsImage returns true if the image distro is "windows".
 func IsWindowsImage(id string) bool {
 	img := FindImage(id)