A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. (CVE-2026-108540)
Description
A critical OS command injection vulnerability exists in OpenSpug Spug versions up to 3.4.0 and 4.0.1 in the file transfer component (/exec/transfer). This flaw allows remote attackers with low privileges to execute arbitrary OS commands without user interaction. The vulnerability has a high CVSS score of 9.9 and an exploit has been published. The vendor has not responded to disclosure requests and no patch information is available.
CVSS v3.1
Score 9.9critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108540 is an OS command injection vulnerability affecting OpenSpug Spug up to versions 3.4.0 and 4.0.1. The flaw resides in an unknown function within the /exec/transfer file of the File Transfer component. Successful exploitation allows remote attackers with low privileges to execute arbitrary operating system commands, potentially leading to complete system compromise. The vulnerability has a CVSS v3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). An exploit has been publicly published, and the vendor has not provided any response or patch.
Potential Impact
The vulnerability enables remote attackers with low privileges to execute arbitrary OS commands on affected systems, resulting in full confidentiality, integrity, and availability compromise. This can lead to complete system takeover, data loss, or disruption of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the vulnerable component and monitor for exploit attempts. Applying network-level controls to limit exposure may reduce risk until a patch is released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wv44-gq26-hmfv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108540"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acc00cc2cdf04f656feea3d
Added to database: 10/11/2026, 21:34:04 UTC
Last enriched: 10/11/2026, 21:54:04 UTC
Last updated: 10/11/2026, 22:48:07 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.