CVE-2026-47359

An OS Command Injection vulnerability exists in Apache CloudStack's NAS backup provider plugin . The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized mount command options for backup repositories. A malicious operator ac...

CVE-2026-47359 Apache CloudStack: OS Command Injection due to unsanitized mount command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...