CVE-2026-25108

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Soliton Systems K.K.	FileZen	V5.0.0 to V5.0.10
Soliton Systems K.K.	FileZen	V4.2.1 to V4.2.8

References

https://jvn.jp/en/jp/JVN84622767/Third Party Advisory
https://www.soliton.co.jp/support/2026/006657.htmlVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25108US Government Resource

Timeline

Published: Feb 13, 2026
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251098.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote CVE-2026-25117.5The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter CVE-2026-251103.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-251118.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote co CVE-2026-251127.8A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.CVE-2026-251139.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-251149.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-251159.9n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated use CVE-2026-251168.8Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulne CVE-2026-251178.3pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sand CVE-2026-251187.5immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable t CVE-2026-251197.7Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the confi