Skip to content
Critical OS Command Injection Vulnerability in OpenSpug Spug

Critical OS Command Injection Vulnerability in OpenSpug Spug

First seen 11 Oct 2026, 17:30 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 12, 2026 at 00:58 UTC
  • •CVE-2026-108540 is a critical OS command injection vulnerability with a CVSS score of 9.9.
  • •Affected versions of OpenSpug Spug include 3.0 to 4.0.1, allowing remote command execution.
  • •No patch is available, and a public proof-of-concept exploit exists, increasing urgency for mitigation.

A critical OS command injection vulnerability, CVE-2026-108540, has been identified in OpenSpug Spug versions up to 4.0.1, allowing remote attackers to execute arbitrary OS commands. This flaw affects the file transfer functionality (/exec/transfer) and requires low privileges for exploitation. Affected versions include 3.0 to 4.0.1, putting numerous deployments at risk, particularly those managing sensitive infrastructure. While a public proof-of-concept exploit is reported to exist, the vendor has not responded to the disclosure, and no patch is currently available. Security professionals are advised to restrict network access to the vulnerable endpoint and implement strict input validation. The CVSS score for this vulnerability is 9.9, indicating a critical severity level. The situation is urgent as exploitation is considered easy and may lead to significant system compromise.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-11
CVE-2026-108540 published
A critical OS command injection vulnerability in OpenSpug Spug was disclosed, affecting versions up to 4.0.1.
Feedly
2026-10-11
Public proof-of-concept reported
A public proof-of-concept exploit for CVE-2026-108540 has been reported, raising concerns about exploitation.
ThreatAft

More articles in this cluster (2)

Following this threat?

Track CVE-2026-108540 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

Which versions of OpenSpug are affected?
OpenSpug versions 3.0 to 4.0.1 are affected by CVE-2026-108540.
Is there a patch available for this vulnerability?
No, there is currently no patch available for CVE-2026-108540.
What immediate actions should be taken?
Restrict network access to the /exec/transfer endpoint and implement strict input validation.