{"id":"CVE-2026-108546","published":"2026-10-10T15:16:57.573","lastModified":"2026-10-16T19:21:14.417","description":"Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/spotweb/spotweb","tags":[]},{"url":"https://github.com/spotweb/spotweb/blob/1.5.8/lib/services/NzbHandler/Services_NzbHandler_Runcommand.php#L41-L45","tags":[]},{"url":"https://hackmd.io/@haind/spotweb-runcommand-title-injection","tags":[]},{"url":"https://www.vulncheck.com/advisories/spotweb-through-1.5.8-os-command-injection-via-spot-title-in-runcommand-integration","tags":[]}],"exploitRefs":[{"url":"https://github.com/spotweb/spotweb","tags":[]},{"url":"https://github.com/spotweb/spotweb/blob/1.5.8/lib/services/NzbHandler/Services_NzbHandler_Runcommand.php#L41-L45","tags":[]}],"hasPoc":true,"ai":{"summary":"Spotweb allows remote command injection through malicious spot titles, enabling attackers to execute arbitrary commands as the PHP process when users download spots. This vulnerability can lead to full system compromise.","exploitability":"Exploitation requires posting a self-signed Usenet spot with shell metacharacters in the title, which is relatively straightforward but depends on users downloading the malicious spot.","blast_radius":"The impact could be significant as attackers can execute commands with the privileges of the Spotweb PHP process, potentially leading to data exfiltration, system compromise, or lateral movement within the network.","remediation":"Upgrade to Spotweb 1.5.9 or later to address this OS command injection vulnerability.","detection":"Monitor for unusual command execution patterns in system logs when users download spots, particularly looking for shell metacharacters in titles that trigger exec() calls.","tags":["rce","command-injection","web","usenet"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:44.481Z"}}