CVE-2026-25108highunder attackCWE-78

CVE-2026-25108: high-severity vulnerability in Soliton Systems K.K. FileZen

Published · Updated

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.7epss 5.2%
from disclosure to weapon
Published on NVDFeb 13
CISA KEV+11d
exploitation probability
5.2%top 7% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2026-03-17

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

FileZen has a flaw that allows a logged-in user to run unauthorized commands on the server by sending specially crafted requests when the Antivirus Check feature is enabled. This lets attackers take control of the system.

Technical detail

OS command injection vulnerability (CWE-78) in FileZen's Antivirus Check feature allows authenticated users to execute arbitrary OS commands via maliciously crafted HTTP requests. Exploitation requires valid user credentials and the feature to be enabled; successful exploitation grants command execution with application privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Soliton Systems K.K. · FileZen
Related CVEs — Soliton Systems K.K. FileZen

In the same product, most dangerous first.

CVE-2020-5639—CVE-2020-5639EPSS 5.1%CVE-2021-20655—CVE-2021-20655EPSS 3.5%CVE-2018-0694—CVE-2018-0694EPSS 2.4%CVE-2018-0693—CVE-2018-0693EPSS 1.9%
References
https://jvn.jp/en/jp/JVN84622767/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25108https://www.soliton.co.jp/support/2026/006657.html