{"id":"CVE-2026-85523","published":"2026-10-06T14:17:47.240","lastModified":"2026-10-06T20:17:33.987","description":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection.\n\nThis issue affects SambaBox: before 5.4.1.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1258","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is an OS command injection vulnerability in SambaBox versions before 5.4.1, allowing attackers to execute arbitrary system commands.","exploitability":"Exploitation is relatively straightforward given the attacker can craft a malicious input to inject OS commands, requiring preconditions such as user input control.","blast_radius":"If exploited, this could lead to complete compromise of the affected system, including data theft, service disruption, and potential lateral movement.","remediation":"Upgrade to SambaBox 5.4.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","os-command-injection","patch-required"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:59:07.256Z"}}