CVE-2026-47359: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Apache Software Foundation Apache CloudStack

This vulnerability (CVE-2026-47359) involves improper neutralization of special elements in OS commands (CWE-78) within Apache CloudStack's NAS backup provider plugin. Specifically, the addBackupRepository API (available since version 4.20.0.0) and the updateBackupRepository API (introduced in 4.22.0.0) accept command options without proper sanitization. A malicious operator account can leverage this flaw to inject arbitrary OS commands that execute on the KVM hypervisor host when any account performs a backup restore. The affected versions include 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The vendor has released fixed versions 4.20.3.1 and 4.22.1.1 to address this issue.

Successful exploitation allows a malicious operator account to execute arbitrary commands on the KVM hypervisor host, potentially leading to full compromise of the host system. This can result in complete confidentiality, integrity, and availability loss for the affected system. The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges of an operator account, no user interaction, and high impact on confidentiality, integrity, and availability.

Users should upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory information.