Riskcovery

CVE-2025-59302

Apache CloudStack: Potential remote code execution on Javascript engine defined rules

State
Published
Severity
4.7 Medium
Published
Nov 27, 2025
Updated
Feb 26, 2026
Reserved
Sep 12, 2025

Read the record on cve.org

Description

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

* quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage

This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LCISA-ADP

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
Apache CloudStackApache Software Foundation
  • 4.18.0 to before 4.20.2Affected
  • 4.21.0 to before 4.22.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.