CVE-2025-14108

HIGH 8.8CVE-2025-14108 · Published 05/12/2025 · updated 25/09/2026

In short

CVE-2025-14108 is a HIGH (CVSS 8.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 10.5%, higher than 95.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safe_dir causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.

References

vuldb.com · VDB Entry
vuldb.com · VDB Entry
vuldb.com · VDB Entry
notion.so/2af6cf4e528a80258f60fa529c48d291 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free