---
id: CVE-2026-15547
title: A weakness has been identified in Shibby Tomato up to 1.28.0000
summary: >-
  A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects
  the function sub_2D048 of the component CIFS Mount Handler. Executing a
  manipulation of the argument cifs1/cifs2 can lead to os command injection. The
  attack c…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-77
  - CWE-78
published: '2026-07-13'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15547'
references:
  - url: 'https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5P'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-15547'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/855117'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/377897'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/377897/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-07-13T12:26:57.458Z'
epss: 0.01768
epssPercentile: 0.77138
---

## Overview

A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulation of the argument cifs1/cifs2 can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This project is superseded by FreshTomato.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.