CVE-2025-59302

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

CVSS 3.1

4.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS

0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-25)

CWE

CWE-94

Published

2025-11-27

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• apache:cloudstack

References

• https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788
• http://www.openwall.com/lists/oss-security/2025/11/27/2

Check your stackJSON