CVE-2026-85523: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Felisify Information Technologies Industry and Trade Inc. SambaBox

The vulnerability identified as CVE-2026-85523 in SambaBox is due to improper neutralization of special elements used in OS commands, classified under CWE-78 (OS command injection). This flaw allows an attacker with low privileges to execute arbitrary OS commands without user interaction. The affected versions are all SambaBox releases before 5.4.1. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. Because the attack vector is network-based and requires only low privileges, the risk is significant in environments where SambaBox is deployed.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to SambaBox services and monitor for suspicious activity related to command execution attempts.