Code Injection Vulnerability in Apache CloudStack APIs Affecting Admins

CVE-2025-59302

What is CVE-2025-59302?

A code injection vulnerability has been identified in Apache CloudStack, impacting specific admin-accessible APIs. The APIs affected include quotaTariffCreate, quotaTariffUpdate, createSecondaryStorageSelector, updateSecondaryStorageSelector, updateHost, and updateStorage. This vulnerability allows unauthorized code execution under certain conditions where admin privileges are necessary. The recommended remediation is to update to versions 4.20.2 or 4.22.0, which implement a global configuration flag, js.interpretation.enabled, to better control JavaScript expression interpretation, effectively reducing the risk associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References