CVE-2026-108540

Summary

OpenSpug's file transfer functionality contains an OS command injection vulnerability that allows remote attackers with limited privileges to execute arbitrary commands on the server. This critical flaw can lead to full system compromise.

Exploitability

The exploit is highly practical with no complex preconditions, requiring only a remote authenticated user to manipulate the file transfer component and trigger command injection.

Blast radius

If exploited, this vulnerability could allow attackers to gain complete control over the OpenSpug server, potentially leading to data exfiltration, lateral movement, or complete system takeover.

Detection

Monitor for unusual process execution patterns in system logs when users access the /exec/transfer endpoint, particularly shell commands with suspicious parameters or unexpected user privileges.

Prioritized remediation

Upgrade to OpenSpug version 3.4.1 or 4.0.2 which contains the fix for this command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.