Threats affecting pkg:github/openspug/spug

CVE-2026-108540 is a critical OS command injection vulnerability in OpenSpug Spug affecting versions 3.0 through 3.4.0 and 4.0.0 through 4.0.1. The flaw exists in an unspecified function within the /exec/transfer file of the File Transfer component. This vulnerability allows remote attackers to execute arbitrary OS commands without user interaction and with low attack complexity. Exploit code has been published, but no vendor response or patch is currently available.

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.