VYPR
← All advisories
Medium severity4.7NVD Advisory· Published Nov 27, 2025· Updated Jun 17, 2026

CVE-2025-59302

CVE-2025-59302

Description

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

  • quotaTariffCreate
  • quotaTariffUpdate
  • createSecondaryStorageSelector
  • updateSecondaryStorageSelector
  • updateHost
  • updateStorage

This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Apache/Cloudstack4 versions
    cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*range: >=4.18.0.0,<4.20.2.0
    • cpe:2.3:a:apache:cloudstack:4.21.0.0:*:*:*:*:*:*:*
    • (no CPE)range: >=4.18.0 <4.20.2, >=4.21.0 <4.22.0
    • (no CPE)range: 4.18.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.