CVE-2025-59302: Apache CloudStack: Potential remote code execution on Javascript engine defined rules

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-27 · updated 2026-10-18
Weakness: CWE-94

Description

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

Affected products

Apache Software Foundation Apache CloudStack: from 4.18.0.0 before 4.20.2.0; 4.21.0.0 — fixed in 4.20.2.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CloudStack 4.20.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-59302 or the next vulnerability affects your stack