OS Command Injection Vulnerability in FileZen by Soliton Technologies

CVE-2026-25108

What is CVE-2026-25108?

CVE-2026-25108 is an OS command injection vulnerability found in FileZen, a product developed by Soliton Systems K.K. FileZen is designed to securely manage and share files within organizations, providing features such as access control, file encryption, and auditing. The vulnerability arises when the Antivirus Check Option within FileZen is enabled, allowing authenticated users to craft specific HTTP requests that can execute arbitrary operating system commands on the server. This capability poses a serious threat as it can lead to unauthorized access and manipulation of the system, breaching the security measures intended to protect sensitive data and operations.

Potential impact of CVE-2026-25108

1. Unauthorized System Control: The vulnerability allows attackers to execute arbitrary commands on the operating system, which can lead to complete takeover of the impacted FileZen server. This can result in unauthorized access to sensitive files, alteration of system configurations, or deployment of malicious software.

2. Data Breaches and Data Integrity Issues: By executing OS commands, attackers may manipulate, steal, or delete critical files managed by FileZen. This can compromise the confidentiality and integrity of organizational data, impacting business operations and leading to potential legal repercussions.

3. Increased Attack Surface for Further Exploitation: Successful exploitation of this vulnerability can provide attackers a foothold in the organization’s environment, allowing them to pivot to other internal systems. This lateral movement capability significantly amplifies the risk of a broader security breach, potentially leading to extensive data loss or operational disruption.

References