CVE-2026-25108
Soliton Systems K.K FileZen OS Command Injection Vulnerability
Description
CVE-2026-25108 is a high-severity OS command injection vulnerability in Soliton Systems FileZen, a file sharing and transfer appliance widely used in enterprise environments. The vulnerability allows an authenticated attacker with low-level privileges to inject and execute arbitrary operating system commands on the underlying server through crafted requests to the web interface. With a CVSS v3.1 base score of 8.8, successful exploitation leads to complete system compromise, granting the attacker full control over the FileZen appliance and any data it manages. CISA has added CVE-2026-25108 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 17, 2026, and its EPSS score of 28.31% at the 96th percentile indicates a very high probability of exploitation, making this one of the most actively targeted vulnerabilities in file transfer appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| soliton | filezen | >= 4.2.1, < 5.0.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://jvn.jp/en/jp/JVN84622767/(Third Party Advisory)
- https://www.soliton.co.jp/support/2026/006657.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25108(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2026-25108 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. This weakness occurs when an application constructs operating system commands using user-supplied input without properly neutralizing special characters that can alter the intended command structure. In the FileZen web interface, certain request parameters are incorporated into system-level commands executed on the underlying server. Because the application fails to sanitize metacharacters such as semicolons, pipes, backticks, or command substitution sequences, an attacker can append or inject additional commands that the operating system executes with the privileges of the web application process. This class of vulnerability is consistently ranked among the most dangerous software weaknesses due to its direct path from user input to system-level execution.
Impact Analysis
The impact of CVE-2026-25108 spans all dimensions of the CIA triad with high severity. Confidentiality is fully compromised because OS command injection grants the attacker the ability to read any file accessible to the web application process, which on FileZen appliances typically includes all shared files, user credentials, configuration data, encryption keys, and audit logs. Given that FileZen is specifically designed for file sharing and transfer, the volume of sensitive data at risk is substantial.
Integrity faces maximum impact as the attacker can modify any file on the system, alter application configurations, inject persistent backdoors, modify transfer logs to conceal activity, and potentially manipulate files being transferred between parties. In regulated industries where file integrity is critical for compliance, this represents a severe risk.
Availability is fully at risk since the attacker can execute commands that disable the FileZen service, corrupt the file system, consume system resources, or destroy data. The attack is network-accessible (AV:N) with low complexity (AC:L), requiring only low-level privileges (PR:L) and no user interaction (UI:N). Any authenticated user, including those with minimal file-sharing permissions, can potentially exploit this vulnerability, significantly expanding the pool of potential attackers to include disgruntled employees, compromised accounts, or external users with guest access.
Exploit Maturity
CVE-2026-25108 demonstrates very high exploit maturity, evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog and its extraordinary EPSS score of 28.31% at the 96th percentile. This places it among the top 4% of all vulnerabilities in terms of exploitation probability, indicating widespread and active exploitation campaigns.
The Soliton advisory (soliton-sa-2026-001) provides the official vendor disclosure. File transfer appliances have become prime targets for threat actors, particularly ransomware groups and advanced persistent threat (APT) operators, following high-profile exploitation campaigns against similar products. The pattern of targeting file sharing platforms is well-established in the threat landscape, as these systems typically contain large volumes of sensitive data and are accessible from the network. Although CISA classifies the ransomware association as unknown for this specific CVE, the vulnerability profile closely matches those exploited in previous file transfer appliance campaigns that resulted in mass data exfiltration and extortion.
Remediation
Immediate patching is the highest priority. Organizations running Soliton FileZen must upgrade to version 5.0.4 or later for installations on the 3.x–5.0.x branch, or to version 5.4.2 or later for installations on the 5.1.x–5.4.x branch. The Soliton advisory at soliton-sa-2026-001 provides specific upgrade procedures and compatibility guidance.
Access restriction should be implemented immediately as a compensating control. Review and minimize the number of user accounts with access to the FileZen web interface. Disable any guest or external user accounts that are not strictly necessary. Implement IP-based access controls to limit web interface access to trusted network ranges.
Forensic investigation is strongly recommended before and after patching. Examine web server logs for unusual requests, particularly those containing shell metacharacters or unexpected parameter values. Check for unauthorized files, new user accounts, modified configurations, or evidence of data exfiltration. File transfer appliances should be treated as potentially compromised if they were running vulnerable versions while exposed to untrusted networks.
Data protection measures should include reviewing all files stored on the appliance for signs of tampering and notifying affected data owners. Consider rotating any credentials, API keys, or certificates that were stored on or transmitted through the compromised FileZen instance. Implement network-level monitoring to detect any command-and-control communications from the appliance.
Technical Details
CVE-2026-25108 is an OS command injection vulnerability in the Soliton FileZen web interface. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-accessible attack that requires only low privileges and no user interaction, with high impact across all three CIA dimensions.
The vulnerability exists in the request handling logic of the FileZen web application. When an authenticated user submits certain requests through the file sharing interface, the application incorporates user-supplied parameters into operating system commands that are executed on the underlying server. The application fails to sanitize or properly escape shell metacharacters in these parameters, allowing an attacker to inject additional commands using techniques such as command chaining (;), piping (|), command substitution (` or $()), or boolean operators (&&, ||).
The injected commands execute with the privileges of the web server process, which on FileZen appliances typically runs with elevated permissions to manage file operations and system services. This level of access is sufficient to read and modify any file on the system, install persistent access mechanisms, establish reverse shells for ongoing remote access, and exfiltrate data.
Affected versions include FileZen 3.0 through 5.0.3 and FileZen 5.1 through 5.4.1. The fixes in versions 5.0.4 and 5.4.2 implement proper input validation and parameterized command execution to prevent user input from being interpreted as command syntax by the operating system shell.
Frequently Asked Questions
What is CVE-2026-25108?
CVE-2026-25108 is an OS command injection vulnerability in the Soliton FileZen file sharing appliance. It allows an authenticated attacker with low privileges to execute arbitrary operating system commands on the underlying server through crafted web requests.
How likely is exploitation of CVE-2026-25108?
Exploitation likelihood is very high. The EPSS score of 28.31% at the 96th percentile indicates this vulnerability is among the most likely to be exploited. CISA has confirmed active exploitation by adding it to the KEV catalog.
Which versions of FileZen are affected?
Soliton FileZen versions 3.0 through 5.0.3 and versions 5.1 through 5.4.1 are vulnerable. Organizations should upgrade to version 5.0.4 or 5.4.2, respectively.
Can this vulnerability be exploited remotely?
Yes. The vulnerability is exploitable over the network by any authenticated user with low-level privileges. No user interaction is required beyond sending a crafted HTTP request to the FileZen web interface.
Why are file transfer appliances frequently targeted?
File transfer appliances store and transmit large volumes of sensitive data, making them high-value targets for data exfiltration and ransomware campaigns. Their network-accessible nature and the critical data they handle make them attractive to both opportunistic and advanced threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.