CVE-2026-25108

What it actually does

CVE-2026-25108 is an authenticated OS command injection flaw in FileZen when the Antivirus Check Option is enabled. A logged-in user can submit a crafted HTTP request that causes attacker-controlled input to be interpreted by the underlying operating system shell, allowing arbitrary command execution with the privileges of the FileZen application or service account. Because the vulnerability is network reachable, low complexity, requires no user interaction, and can compromise confidentiality, integrity, and availability, successful exploitation can lead to full application host takeover.

Why it matters to the business

An attacker with any valid FileZen account, or access to stolen credentials, could turn a file-sharing or transfer appliance into a foothold for data theft, malware staging, lateral movement, service disruption, or destruction of stored files. This issue is listed in CISA KEV with active exploitation in the wild and a remediation deadline of 2026-03-17, so exposed systems should be treated as high-priority even though the EPSS score is moderate. If FileZen is internet-facing or used to exchange sensitive files with partners, the operational risk includes breach notification, interruption of file exchange workflows, and compromise of downstream systems that trust the appliance.

How an attack unfolds

An attacker first obtains a valid FileZen login through credential theft, password spraying, phishing, reuse of leaked credentials, or abuse of an existing low-privileged account. They then confirm that the Antivirus Check Option is enabled and send a specially crafted HTTP request to the vulnerable antivirus-check workflow. Malicious input embedded in the request is passed unsafely to an operating-system command, causing the FileZen host to execute commands chosen by the attacker. The attacker may run reconnaissance commands, write files, create persistence, download additional tooling, exfiltrate files stored on the appliance, or pivot further into the network. Because the vulnerability is in CISA KEV and marked as actively exploited, defenders should assume public exploit knowledge and opportunistic scanning or targeted exploitation may be occurring.

How to fix it

Upgrade FileZen to the vendor-fixed release that addresses the OS command injection vulnerability, following Soliton Systems guidance for the deployed product version. If immediate patching is not possible, disable the FileZen Antivirus Check Option until the fix is applied, restrict access to the FileZen web interface to trusted networks or VPN users, enforce MFA for all accounts, remove unnecessary accounts, and monitor for suspicious authenticated activity. Because the supplied package metadata lists FreeRDP-related Chainguard/Wolfi packages with fixed version value "0" while the vulnerability description concerns FileZen, validate product applicability against the authoritative FileZen/Soliton advisory rather than relying only on downstream package names. Treat any internet-facing or partner-facing FileZen instance as urgent due to KEV status and active exploitation.

How to confirm the fix worked

Confirm the deployed FileZen version is at or above the vendor-fixed release and that no vulnerable builds remain in production, disaster recovery, test, or externally exposed environments. Verify whether the Antivirus Check Option is enabled; if a compensating control is required, confirm it is disabled until the patch is installed. Review configuration and network exposure to ensure only authorized sources can reach the FileZen web interface. Use a safe, vendor-provided or internally approved validation method to confirm crafted input is rejected or sanitized and does not cause child shell processes to spawn. Check endpoint telemetry during validation to ensure the FileZen service does not launch command interpreters or network utilities in response to antivirus-check requests.

Typical attack path

1. Obtain valid credentials for a FileZen user account or compromise an existing session.
2. Access the FileZen web interface over the network.
3. Identify that the Antivirus Check Option is enabled and reachable.
4. Send a crafted HTTP request to the antivirus-check functionality containing shell metacharacters or command-substitution syntax.
5. Achieve command execution as the FileZen application/service account.
6. Run discovery commands to identify host privileges, network access, files, and credentials.
7. Stage malware, web shells, reverse shells, or persistence mechanisms if permissions allow.
8. Exfiltrate stored files or use the appliance as a pivot point for broader intrusion activity.

How to detect it

Look for signs that authenticated FileZen web requests triggered operating-system activity. Primary sources include FileZen application logs, web server access logs and error logs, authentication/session logs, EDR process creation telemetry, shell history where available, file integrity monitoring, scheduled task or cron records, and firewall/proxy/DNS logs for unexpected outbound traffic from the FileZen host. In HTTP logs, search for requests to antivirus-check related functionality containing URL-encoded shell metacharacters, command separators, command substitution syntax, or long encoded payloads. In EDR, alert when the FileZen service, web server, Java runtime, application server, or antivirus integration process spawns /bin/sh, bash, cmd.exe, PowerShell, curl, wget, certutil, nc, ncat, python, perl, or similar utilities. Also hunt for new or modified executable files in web-accessible directories, unexpected archives of FileZen-stored files, unusual login timing, failed-then-successful login patterns, and outbound connections to unfamiliar IPs shortly after antivirus-check requests. If exploitation is suspected, preserve logs and disk artifacts before patching or rebooting where possible.

• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• curl http
• curl https
• wget http
• wget https
• nc -e
• ncat -e
• bash -i
• /dev/tcp/
• python -c
• perl -e
• chmod +x
• crontab -e
• /etc/cron.d/
• %3B
• %26%26
• %7C
• %60
• %24%28
• ;whoami
• ;id
• && whoami
• && id
• | whoami
• | id

What your security team should do

• Prioritize remediation of all FileZen systems before the CISA KEV due date of 2026-03-17, with emergency handling for internet-facing instances.
• Inventory FileZen deployments and confirm whether the Antivirus Check Option is enabled.
• Patch to the vendor-fixed FileZen release; if patching is delayed, disable the Antivirus Check Option and restrict web access to trusted networks.
• Review authentication controls, rotate potentially exposed FileZen credentials, and enforce MFA for administrative and user accounts where supported.
• Hunt for evidence of exploitation across web logs, application logs, EDR process telemetry, file integrity data, and outbound network connections.
• Investigate any instance where the FileZen service spawned shells, scripting interpreters, download tools, archive utilities, or network tunneling tools.
• Review files stored on affected systems for unauthorized access or exfiltration indicators.
• Do not rely solely on EPSS for prioritization; KEV status and active exploitation should drive urgency.