AnyShare contains an unauthenticated OS command injection vulnerability (CWE-78) in the ServiceAgent API's /api/ServiceAgent/start_service endpoint on port 10250. The endpoint accepts POST requests with user-supplied input that is not properly sanitized, allowing injection of shell syntax interpreted by the backend system. This enables remote attackers to execute arbitrary commands without authentication. The vulnerability affects builds released before August 2025. While the exact affected version range is undefined, newer versions reportedly include a fix. The vulnerability was first observed exploited by Shadowserver Foundation on 2025-07-11 UTC. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected AnyShare server, potentially leading to full system compromise. This can result in unauthorized access, data theft, service disruption, or further network penetration. The vulnerability is critical with a CVSS 4.0 score of 10.0, reflecting its high severity and ease of exploitation over the network without any privileges or user interaction.

The vulnerability is reportedly remediated in newer versions of AnyShare released after August 2025. However, the exact affected version range and patch details are not provided. Users should upgrade to the latest available version of AnyShare to ensure the fix is applied. Since no official patch links or vendor advisories are provided, confirm patch availability and remediation guidance directly with Shanghai Aishu Information Technology Co., Ltd. or their official channels. Until patched, restrict access to port 10250 and monitor for suspicious activity targeting the ServiceAgent API endpoint.