The FILES Directive allows arbitrary files from the frontend system (including sensitive files) to be included when a VM is started from that template, which may result in Information Disclosure.
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.
The default configuration for opennebula datastores only restricts the OpenNebula directories themselves, for systems that run VMs on the same host as the frontend processes, this configuration is vulnerable
Workarounds
Set the datastore RESTRICTED_DIRS directive to "/" for any datastores that are mounted on the frontend host.