CVE-2026-47359: Apache CloudStack: OS Command Injection due to unsanitized mount command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subsequently performs a backup restore.
This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.20.3.1 - Upgrade
Upgrade
Apache CloudStackto a version that resolves this vulnerability.Fixed in 4.22.1.1
Event History
Frequently Asked Questions
Who can exploit this issue, and where do injected commands run?
A malicious CloudStack operator account can supply unsanitized command options through the backup repository APIs. The injected commands execute on a KVM hypervisor host when any account later performs a backup restore.
Which deployments are affected?
The issue affects deployments using the NAS backup provider plugin on versions 4.20.0.0 through 4.20.3.0 or 4.21.0.0 through 4.22.1.0. The vulnerable addBackupRepository API has been available since 4.20.0.0, while updateBackupRepository was introduced in 4.22.0.0.
What should administrators do?
Upgrade to Apache CloudStack 4.20.3.1, 4.22.1.1, or a later version. Until upgrading, treat backup repository command options configured by operator accounts as potentially malicious and avoid backup restores that could trigger execution on KVM hosts.