PT-2026-50878 · Sima Gmbh · Bondix Server

Jonas Friedli · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-12104

Mitre

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber

OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-12104

Affected Products

Bondix Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-12104 · Security Note
• https://wiki.bondix.dev/wiki/Security_Advisories#CVE-2026-12104_%E2%80%94_Authenticated_OS_Command_Injection_in_Bondix · Note
• https://wiki.bondix.dev/wiki/Downloads#Release_Notes · Note