MajorCritical vulnerability

CVE-2026-85523 (CVSS 8.8)

NVD · officialPublished Oct 6, 2026Risk 37/100

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1.

Technical details

CVSS

8.8

AV:NetworkAC:LowPR:LowUI:NoneC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source