OS Command Injection (CVE‑2026‑25108) in Soliton Systems FileZen Enables Remote Code Execution
What It Is — FileZen, the file‑transfer appliance from Soliton Systems K.K., contains an OS command‑injection flaw. An attacker who can send a specially‑crafted HTTP request during the login process can cause the underlying operating system to execute arbitrary commands.
Exploitability — The vulnerability is publicly disclosed (CVE‑2026‑25108) and assigned a CVSS v3.1 base score of 8.8 (High). No public exploit code has been observed, but the attack vector is straightforward (network‑reachable HTTP endpoint).
Affected Products — Soliton Systems K.K. FileZen (all versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls and evidence that patches are applied promptly.
- Highlights gaps in input‑validation and secure‑coding practices, which map to a core control objective across SOC 2, ISO 27001, NIST CSF, and others.
- Provides a concrete audit‑ready indicator: logging of failed login attempts and command‑execution alerts can serve as defensible evidence of a mature control environment.
Recommended Actions
- Apply the vendor’s security patch for CVE‑2026‑25108 immediately.
- Verify that all FileZen instances enforce strict input sanitization on authentication endpoints.
- Update your asset inventory and vulnerability‑scan schedules to include FileZen.
- Enable detailed request‑level logging and monitor for anomalous command‑execution patterns.
- Document the remediation steps in your control‑evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2026‑25108