This vulnerability (CVE-2026-12104) involves improper neutralization of special elements used in OS commands (CWE-78) in the environment and tunnel configuration features of SIMA GmbH Bondix Server versions up to 1.25.7.5 on Linux. An authenticated attacker with configuration write permissions can inject and execute arbitrary operating system commands by supplying specially crafted configuration values that are passed to server-side scripts. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high privileges required. The vulnerability is published and known exploits in the wild are not reported. No patch or official remediation level has been disclosed.

An attacker with configuration write access can execute arbitrary OS commands on the affected server, potentially leading to full system compromise, data loss, or disruption of service. The vulnerability requires authenticated access with high privileges, limiting exposure to trusted users or compromised accounts. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict configuration write access to trusted administrators only and monitor for suspicious configuration changes. Avoid exposing the configuration interfaces to untrusted networks.