This flaw arises from inadequate sanitization of user-supplied input that is passed to system commands. An attacker can inject arbitrary shell commands, leading to full remote code execution on the host running SambaBox. The weakness corresponds to CWE-78.

The affected product is Felisify Information Technologies’ SambaBox. Versions prior to 5.4.1 are vulnerable; the problem exists in the control layer that constructs OS commands from configuration or user input. No other vendor versions are listed.

The CVSS score of 8.8 classifies the issue as high‑severity. Because no EPSS value is provided, exploitation likelihood cannot be quantified at this time. The vulnerability is not yet cataloged in CISA’s KEV list. Attackers would need to reach the SambaBox interface and supply crafted input, so the attack surface is limited to endpoints exposed to untrusted callers, but once reached the impact is critical.