An OS command injection flaw in IBM Aspera Faspex 5 allows a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. The vulnerability is rooted in improper handling of shell arguments, which can lead to the execution of unintended system commands. This capability enables a threat actor to compromise confidentiality, integrity, or availability of the affected host if the injection succeeds.

IBM Aspera Faspex 5, versions 5.0.0 through 5.0.15.4 on Linux platforms, is vulnerable to this flaw. The affected releases are listed in the CPE entries for 5.0.0 and 5.0.15.4, and the issue applies to the Linux deployment of the product.

The CVSS score of 9.1 places the vulnerability in the high‑impact category, while the EPSS score of less than 1% indicates a low probability of exploitation at present time. The flaw requires an attacker to possess authenticated access to the application’s interface; under those conditions, the unauthenticated portion of the command injection is mitigated. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants urgent remediation regardless of the low EPSS figure.