CVE-2025-70039
OS Command Injection in linagora Twake v2023.Q
Publication date: 2026-03-09
Last updated on: 2026-03-13
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linagora | twake | 2023.q1.1223 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-70039 is a vulnerability in linagora Twake version v2023.Q1.1223 related to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
This means that the software does not properly sanitize special characters in inputs that are used to construct operating system commands.
As a result, an attacker can inject and execute arbitrary OS commands on the affected system.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to full system compromise.
Attackers can execute malicious commands on the affected system, potentially gaining unauthorized access, modifying data, or disrupting services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
This vulnerability arises from insufficient sanitization of special characters in OS command inputs, allowing attackers to execute arbitrary commands.
Immediate mitigation steps include reviewing and updating the affected linagora Twake version v2023.Q1.1223 to ensure proper sanitization of OS command inputs.
If an official patch or update is available from the vendor, apply it promptly.
In the absence of a patch, consider restricting or isolating the affected system to limit potential exploitation.