---
id: CVE-2025-59302
title: >-
  Apache CloudStack: Potential remote code execution on Javascript engine
  defined rules
summary: >-
  In  Apache CloudStack improper control of generation of code ('Code
  Injection') vulnerability is found in the following APIs which are accessible
  only to admins.

    *  quotaTariffCreate
    *  quotaTariffUpdate
    *  createSecondaryStorageS…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'
cvssSource: adp
cwe:
  - CWE-94
vendor: Apache Software Foundation
product: Apache CloudStack
affected:
  - apache_cloudstack >= 4.18.0 < 4.20.2
  - apache_cloudstack >= 4.21.0 < 4.22.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-12-02T04:56:00.679228Z'
published: '2025-11-27'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:03:06.484Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-59302'
references:
  - url: 'https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788'
tags:
  - cve.org
epss: 0.0049
epssPercentile: 0.424
ingestedAt: '2026-11-05T20:33:06.567Z'
---

## Overview

In  Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

  *  quotaTariffCreate
  *  quotaTariffUpdate
  *  createSecondaryStorageSelector
  *  updateSecondaryStorageSelector
  *  updateHost
  *  updateStorage


This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

## Affected

- `apache_cloudstack >= 4.18.0 < 4.20.2`
- `apache_cloudstack >= 4.21.0 < 4.22.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.