An issue was discovered in Xapi, where metadata injection attack could be performed against backup/restore functionality. A malicious guest can manipulate its disk to appear to be a metadata backup. To leverage the vulnerability, an attacker would likely need insider information to construct a plausible-looking metadata backup, and would have to persuade a real administrator to perform a data-recovery action. Systems running Xapi v1.249.x are affected.