CVE-2025-59302
Severity CVSS v4.0:
Pending analysis
Type:
CWE-94
Code Injection
Publication date:
27/11/2025
Last modified:
27/11/2025
Description
In Apache CloudStack improper control of generation of code (&#39;Code Injection&#39;) vulnerability is found in the following APIs which are accessible only to admins.<br />
<br />
* quotaTariffCreate<br />
* quotaTariffUpdate<br />
* createSecondaryStorageSelector<br />
* updateSecondaryStorageSelector<br />
* updateHost<br />
* updateStorage<br />
<br />
<br />
This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.<br />
<br />
The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.