CVE-2026-25108: Critical FileZen Command Injection Flaw Actively Exploited, Immediate Patch Urged

CVE-2026-25108 – FileZen OS Command Injection

CVE ID: CVE-2026-25108
Product: FileZen (Soliton Systems)
Vulnerability Type: OS Command Injection (CWE-78)
CVSS v3.x Score: 8.8 (High)
Severity: High
Attack Vector: Remote (Authenticated)
Privileges Required: Low (Valid user account)
User Interaction: Not required beyond login
Exploit Status: Active exploitation reported
Public PoC: No widely distributed public exploit kit, but exploitation activity has been observed
Fixed Version: FileZen V5.0.11
Official Patch / Upgrade Link: Link provided below

Overview

A critical OS command injection vulnerability has been identified in FileZen versions V4.2.1 through V5.0.10. The issue exists in functionality associated with the Antivirus Check feature. When this option is enabled, user-supplied input is passed to system-level commands without proper sanitization or neutralization.

If exploited, arbitrary operating system commands may be executed under the context of the FileZen service account. In environments where the service runs with elevated privileges, full system compromise is possible.

The vulnerability requires authentication; however, any valid user account is sufficient. Because authenticated access is common in file transfer systems, the practical exploitation risk remains significant.

Affected Versions

FileZen V4.2.1
FileZen V4.2.x
FileZen V5.0.0 through V5.0.10

Not affected: V5.0.11 and later

Technical Root Cause

Improper input validation allows command injection when user-controlled input is incorporated into backend OS-level antivirus scanning routines. Special shell characters are not properly filtered before execution.

Typical unsafe patterns observed in similar cases include:

Direct concatenation of user input into command strings
Invocation of system shell interpreters without strict argument handling
Failure to escape shell metacharacters

Because antivirus scanning may rely on command-line execution of external engines, unsafe parameter handling introduces the injection risk.

Exploitation Conditions

The following conditions must be met:

Antivirus Check feature enabled
Valid login credentials
Ability to submit crafted HTTP requests to affected endpoints

No administrator privileges are required.

Exploitation Scenario (Educational)

A typical attack chain may proceed as follows:

Attacker gains valid credentials (phishing, password reuse, brute force).
Attacker logs into FileZen web interface.
A specially crafted HTTP request is submitted to a post-login function related to file scanning or antivirus validation.
Injection characters modify the backend system command.
Arbitrary commands execute on the host system.

Possible post-exploitation actions include:

Establishing persistence
Creating new system users
Uploading web shells
Dumping credentials
Lateral movement

No working exploit code is being provided here. The above explanation is intended strictly for defensive awareness.

MITRE ATT&CK Mapping

T1078 – Valid Accounts
T1059 – Command and Scripting Interpreter
T1105 – Ingress Tool Transfer
T1053 – Scheduled Task / Job (persistence possibility)

Indicators of Exploitation

Web Application Indicators

Suspicious characters in HTTP parameters:
- ;
- &&
- |
- `
- $()
Unusually long parameter values
Encoded command separators
Repeated requests to antivirus-related endpoints
Unexpected 500 errors followed by successful execution responses

Host-Based Indicators

Shell processes spawned by FileZen service:
- cmd.exe
- powershell.exe
- sh
- bash
Unexpected child processes from web server parent
Creation of new system users
Modified scheduled tasks or cron jobs
Unexpected outbound network connections

Network Indicators

Outbound traffic to unfamiliar IPs immediately after login activity
DNS lookups to suspicious domains
Data exfiltration patterns

Log Sources Required for Detection

FileZen application logs
Web server access logs (Apache/IIS)
Windows Event Logs (Security, Sysmon, PowerShell)
Linux syslog / auditd
EDR telemetry
Firewall logs
DNS logs

Detection Rules and Queries

Splunk – Suspicious Command Characters in Web Requests

index=web_logs sourcetype=access_combined "FileZen"
| search uri_query="*;*" OR uri_query="*&&*" OR uri_query="*|*" OR uri_query="*`*" OR uri_query="*$(*"
| stats count by clientip, user, uri, uri_query, _time

Splunk – Suspicious Process Spawn from FileZen

index=endpoint_logs EventCode=1
| where ParentImage="*FileZen*" AND 
  (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*sh" OR Image="*bash")
| table _time, host, ParentImage, Image, CommandLine, User

Elastic Query – Suspicious Child Processes

process.parent.name : "filezen" AND
(process.name : "cmd.exe" OR process.name : "powershell.exe" 
 OR process.name : "sh" OR process.name : "bash")

Windows Event Log – PowerShell Spawned by Service Account

EventID=4688
NewProcessName="*powershell.exe"
ParentProcessName="*FileZen*"

Linux Auditd – Shell Execution

type=EXECVE 
exe="/bin/bash" OR exe="/bin/sh"

Filter where parent process equals FileZen service.

Threat Hunting Guidance

Correlate login events with process creation within 2–5 minutes.
Identify first-time login IP addresses.
Look for command-line arguments containing encoded shell operators.
Investigate unexpected administrative account creations.
Check for new files in web root directories.

Risk Impact

If successfully exploited:

Full system takeover possible
Data theft or modification
Deployment of ransomware
Supply chain risk if FileZen is used for partner file exchange
Compliance violations (GDPR, HIPAA, etc.)

Impact severity increases if:

FileZen runs with SYSTEM or root privileges
Server is domain-joined
Server has access to sensitive storage

Mitigation and Remediation

Immediate Action

Upgrade to FileZen V5.0.11 immediately.

Official Patch Link:
https://www.soliton.co.jp/support/2026/006657.html

Temporary Mitigation

Disable Antivirus Check feature
Restrict access to trusted IP ranges only
Enforce MFA for all users
Rotate all credentials
Monitor logs continuously

Hardening Recommendations

Run FileZen under least-privileged service account
Disable unnecessary OS command execution permissions
Apply network segmentation
Enable application firewall (WAF)
Implement EDR with command-line monitoring
Enable detailed logging at maximum verbosity

Incident Response Actions

Isolate the host immediately
Preserve logs and volatile memory
Identify malicious processes
Remove persistence mechanisms
Rotate all credentials
Rebuild system if integrity cannot be assured

Exploit Availability Assessment

While no fully weaponized public exploit kit is widely circulated, active exploitation has been observed. Because exploitation requires only authenticated access and basic injection techniques, the barrier to entry is considered low for attackers familiar with web application testing.

Organizations running vulnerable versions should assume exploit attempts will increase rapidly.

Final Takeaway

This vulnerability should be treated as a priority patch. Authenticated command injection flaws frequently lead to full infrastructure compromise. Immediate upgrade to V5.0.11 is strongly advised, followed by credential resets and log review for potential historical exploitation.