CVE-2026-108540: OS Command Injection in OpenSpug Spug

OpenSpug Spug versions 3.0, 3.1, 3.2, 3.3, 3.4.0, 4.0.0, and 4.0.1 contain an OS command injection vulnerability in an unspecified function of the /exec/transfer file within the File Transfer component. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating input to this component. The vulnerability has a CVSS 4.0 base score of 9.4, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, scope, and security requirements. Exploit code is publicly available, and the vendor has not responded to disclosure requests. No official patch or remediation is currently documented.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected systems, potentially leading to full system compromise, data theft, or disruption of services. The vulnerability affects confidentiality, integrity, and availability with high severity. Given the availability of exploit code, the risk of exploitation is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are provided, users should consider applying workarounds such as restricting access to the vulnerable component, implementing network-level controls to limit exposure, or disabling the affected functionality until a fix is available. Monitor official vendor channels for updates.