CVE-2026-47359

Apache CloudStack 's NAS backup provider plugin is vulnerable to OS command injection via the addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0). These APIs accept unsanitized command options for the backup repository, allowing a malicious o...