Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-25108

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:cd5ca58c6de8dd354eb1e8b8cffe08a2e07e0c145daeb1e8bff859581fe61541
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"product":"FileZen","vendor":"Soliton Systems K.K.","versions":[{"status":"affected","version":"V5.0.0 to V5.0.10"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/affected/0

{"product":"FileZen","vendor":"Soliton Systems K.K.","versions":[{"status":"affected","version":"V4.2.1 to V4.2.8"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/affected/1
cvss · 2 assertions

{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"metric_type":"cvssV3_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/metrics/0/cvssV3_0

{"metric":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"metric_type":"cvssV4_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/metrics/1/cvssV4_0

Affected products and versions

2 source assertions
{"product":"FileZen","vendor":"Soliton Systems K.K.","versions":[{"status":"affected","version":"V5.0.0 to V5.0.10"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/affected/0
{"product":"FileZen","vendor":"Soliton Systems K.K.","versions":[{"status":"affected","version":"V4.2.1 to V4.2.8"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/affected/1

Provider-owned CVSS observations

2 source assertions
{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"metric_type":"cvssV3_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/metrics/0/cvssV3_0
{"metric":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/metrics/1/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-78","description":"Improper neutralization of special elements used in an OS command ('OS Command Injection')","lang":"en-US","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/problemTypes/0/descriptions/0

Known exploitation assertions

2 source assertions
{"cwes":["CWE-78"],"dateAdded":"2026-02-24","dueDate":"2026-03-17","knownRansomwareCampaignUse":"Unknown","notes":"https://jvn.jp/en/jp/JVN84622767/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-25108","product":"FileZen","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.","vendorPro…
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:64e8c9976bedf74354ebcb9106b6a9106c8c494c196383296be4284e301997ae · sha256:635dff916c4092c0… · /vulnerabilities/133
    Open source location →
{"cwes":["CWE-78"],"dateAdded":"2026-02-24","dueDate":"2026-03-17","knownRansomwareCampaignUse":"Unknown","notes":"https://jvn.jp/en/jp/JVN84622767/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-25108","product":"FileZen","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.","vendorPro…
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:4bc9eff8a06606de0b3c5fa0d87d319cdbfb84106030066acdb58e79305caf98 · sha256:16acee8334e59e44… · /vulnerabilities/130
    Open source location →

Source references

3 source assertions
{"url":"https://jvn.jp/en/jp/JVN84622767/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/references/1
{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25108"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/adp/0/references/0
{"url":"https://www.soliton.co.jp/support/2026/006657.html"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:96579dae9556175ef10de1ac6890ec9b6a834c2794612d8657b20338053f9353 · sha256:0a25ee4fcf74868c… · /containers/cna/references/0

Attribution and limitations

  • CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer