{"id":"CVE-2026-108540","published":"2026-10-11T07:17:23.303","lastModified":"2026-10-14T03:17:16.197","description":"A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SECWG/CVE/issues/10","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108540","tags":[]},{"url":"https://vuldb.com/submit/948328","tags":[]},{"url":"https://vuldb.com/vuln/416195","tags":[]},{"url":"https://vuldb.com/vuln/416195/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/SECWG/CVE/issues/10","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenSpug's file transfer functionality contains an OS command injection vulnerability that allows remote attackers with limited privileges to execute arbitrary commands on the server. This critical flaw can lead to full system compromise.","exploitability":"The exploit is highly practical with no complex preconditions, requiring only a remote authenticated user to manipulate the file transfer component and trigger command injection.","blast_radius":"If exploited, this vulnerability could allow attackers to gain complete control over the OpenSpug server, potentially leading to data exfiltration, lateral movement, or complete system takeover.","remediation":"Upgrade to OpenSpug version 3.4.1 or 4.0.2 which contains the fix for this command injection vulnerability.","detection":"Monitor for unusual process execution patterns in system logs when users access the /exec/transfer endpoint, particularly shell commands with suspicious parameters or unexpected user privileges.","tags":["rce","command-injection","web","remote"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:43:02.510Z"}}