August 10, 2026

CVE Watchtower


← Back to CVE List

CVE-2025-50121NVD

Vulnerability Summary

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created
over the web interface HTTP when enabled. HTTP is disabled by default.
Severity Level
CRITICAL(9.5)
Published Date
Jul 11, 2025
Last Modified
Jul 15, 2025
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
CWE-78: OS Command Injection ↗
The software constructs all or part of an OS command using externally-influenced input, but does not properly neutralize special elements.
CVSS v4.0 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone

External References