CVE-2026-47359

Apache CloudStack: OS Command Injection due to unsanitized mount command

State: Published
Severity: 8.8 High
Published: Aug 21, 2026
Updated: Aug 26, 2026
Reserved: May 19, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subsequently performs a backup restore.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Apache CloudStackApache Software Foundation	4.20.0.0 through 4.20.3.0Affected 4.21.0.0 through 4.22.1.0Affected

References

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbcvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.