Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies… (CVE-2026-85523)

CVE-2026-85523 describes an OS command injection vulnerability in SambaBox by Felisify Information Technologies Industry and Trade Inc. The vulnerability arises from improper neutralization of special elements in OS commands, allowing attackers with low privileges and no user interaction to execute arbitrary commands remotely. The affected versions are all SambaBox releases prior to 5.4.1. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands on the affected system with the privileges of the SambaBox process. This can lead to full compromise of the system, including unauthorized access to sensitive data, modification or destruction of data, and disruption of service.

A fix is available in SambaBox version 5.4.1 and later. Users should upgrade to version 5.4.1 or newer to remediate this vulnerability. No additional mitigation guidance is provided in the available data. Patch status is confirmed by the version information indicating that versions before 5.4.1 are affected.