CVE-2026-85523
8.8 HIGHPublished 2026-10-06 · Updated 2026-10-06
AI risk analysis
- Summary
- The flaw is an OS command injection vulnerability in SambaBox versions before 5.4.1, allowing attackers to execute arbitrary system commands.
- Exploitability
- Exploitation is relatively straightforward given the attacker can craft a malicious input to inject OS commands, requiring preconditions such as user input control.
- Blast radius
- If exploited, this could lead to complete compromise of the affected system, including data theft, service disruption, and potential lateral movement.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to SambaBox 5.4.1 or later.
rceos-command-injectionpatch-required
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-12541
- HIGHCVE-2026-55157PoC
- HIGHCVE-2026-65130PoC
- HIGHCVE-2026-100368PoC
- HIGHCVE-2026-100844PoC
- CRITICALCVE-2026-100896PoC
- CRITICALCVE-2026-101001PoC
- CRITICALCVE-2026-101002PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.