CVE-2025-50121CWE-78

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated…

Critical · published July 11, 2025

CVSS v4.0

9.5

EPSS

22%

Percentile

97.7

In the wild

Unconfirmed

What it is

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created

over the web interface HTTP when enabled. HTTP is disabled by default.

The record

Technical detail

CVSS v4.0: 9.5 · CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H
EPSS: 0.22067 · 97.7th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2025-07-11T09:14Z

EPSS history

Timeline

11 JUL 09:14Z
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated…
cvelistv5