CVE-2026-85523: OS Command Injection in Felisify Informatics' SambaBox

Q: Which SambaBox versions need remediation?

SambaBox versions before 5.4.1 are affected. Upgrade to version 5.4.1 or later if available.

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires low complexity, and does not require user interaction. The attacker does need low-level privileges.

Q: What is the potential impact of successful exploitation?

Successful exploitation can result in high impact to confidentiality, integrity, and availability, consistent with execution of operating-system commands.

Published Oct 6, 2026

Updated

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection.

This issue affects SambaBox: before 5.4.1.

Affected Software

1 affected component

Felisify Sambabox<5.4.1

Event History

Oct 6, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which SambaBox versions need remediation?

SambaBox versions before 5.4.1 are affected. Upgrade to version 5.4.1 or later if available.

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires low complexity, and does not require user interaction. The attacker does need low-level privileges.

What is the potential impact of successful exploitation?