A vulnerability, which was classified as critical, was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function
zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection.
This vulnerability was named CVE-2025-15131. The attack may be performed from remote. In addition, an exploit is available.
The vendor was contacted early about this disclosure.
