External risk intelligence

Zerox OS Command Injection Via Malicious File Extensions

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85672

The vulnerability exists in a file download and document processing mechanism. Such features are commonly implemented in web applications, APIs, or data processing services that ingest documents from external sources, making them a common part of internet-facing attack surfaces.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the zerox technology, specifically its file download function. It allows for the execution of arbitrary commands by manipulating document URLs, which could potentially lead to a compromise of the system. The primary concern is to confirm if our environment utilizes this technology and is exposed.

Malicious URLs can run commands on affected systems.
This affects systems processing downloaded documents.
Confirm if zerox technology is in use.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by crafting malicious document URLs. These URLs, when processed by the vulnerable component, allow attackers to inject operating system commands that execute before the document is processed. This can lead to the execution of arbitrary code on the server.

Entry condition: Unauthenticated network access.
Trigger point: Crafted document URLs.
Resulting risk: Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary operating system commands on a system running zerox when processing specially crafted document URLs. This occurs because the file download mechanism does not sanitize temporary file extensions, interpolating them directly into shell commands used by poppler utilities, potentially enabling command substitution.

OS commands on the server.
Malicious URLs processed by the service.
Server compromise and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are most likely responsible for addressing this OS command injection vulnerability in the file download mechanism. The first practical step is to identify all instances of the affected technology, assess their exposure and criticality, and then determine the accountable owner to plan remediation.

Application and platform teams should own this.
Verify technology deployment and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the zerox software?

Zerox is a technology designed to process and convert documents. It is typically used in applications that need to ingest, handle, or extract information from files downloaded from various locations, often relying on underlying tools like poppler utilities to manage PDF-related operations during its workflow.

How does this CVE-2026-85672 vulnerability work?

This vulnerability is an OS command injection, classified under CWE-78. It happens because the software takes the file extension from a document URL and includes it directly in a shell command without checking if it is safe. An attacker can use special characters in the URL extension to force the system to run their own unauthorized commands.

Do I need a special setup for this to be triggered?

The trigger requires the software to process a specifically crafted document URL. If the software is not configured to download or process documents from untrusted or user-supplied URLs, it generally cannot be triggered. The flaw specifically relies on the unchecked handling of the file extension during that download process.

Is my system at risk if it uses zerox?

Halo Surface Signal indicates this is a likely concern if your zerox deployment handles documents from external sources, as these document-processing features are often part of internet-facing surfaces. If your instance is purely internal or does not process external URLs, the risk profile changes significantly.

When should I take action for this vulnerability?

You should prioritize identifying where zerox is deployed in your environment immediately. Once you confirm usage, verify if the service handles external document inputs. Coordinate with your application or platform owners to assess the specific reachability of these services and plan the necessary updates to secure the file download mechanism.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.