Tia N.List

Reported by 2 outlets

CVE-2026-108540: Critical OS command injection in OpenSpug Spug 3.0 to 4.0.1

new1.2
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.00 / 2.0 · best outlet weight
Severity
4.90 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.52 / 0.6 · time to second source
Recency
× 0.16 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
1.2 / 10 = base × recency + community
radar.offseq.comthreataft.com CVE-2026-108540 first seen 2d ago

Analysis

CVE-2026-108540 is a critical OS command injection in OpenSpug Spug versions 3.0 to 4.0.1, located in /exec/transfer. The vulnerability carries a CVSS of 9.9, a public PoC is available, and the vendor remains unresponsive with no patch released. Remote attackers can execute arbitrary OS commands through the file-transfer endpoint.

Because the vendor has not responded and no patch exists, exposed instances face immediate, unauthenticated remote compromise. The public PoC lowers the barrier for widespread scanning and exploitation, making this a high-priority exposure for any organization running Spug.

What to watch: whether the vendor releases a fix or if users migrate away from Spug. Defenders should restrict access to /exec/transfer, monitor for unexpected command execution, and treat this as an active exploitation risk until a patch is available.

Timeline

  1. original reporting

    CVE-2026-108540: CRITICAL OS command injection in OpenSpug Spug 3.0 – 4.0.1. Remote attackers can execute arbitrary OS commands. Exploit cod

    radar.offseq.com · 2d ago · October 11th, 2026

    CVE-2026-108540: CRITICAL OS command injection in OpenSpug Spug 3.0 – 4.0.1. Remote attackers can execute arbitrary OS commands. Exploit cod

    via Mastodon https://radar.offseq.com/threat/cve-2026-108540-os-command-injection-in-openspug-spug-6b899c3d670ff1c9

  2. update from threataft.com

    CVE-2026-108540 — OpenSpug Spug, CVSS 9.9 OS command injection in /exec/transfer. Public PoC available. Vendor unresponsive. No patch. Spug

    threataft.com · 2d ago · October 11th, 2026

    Public PoC available. Vendor unresponsive. No patch. Spug

    via Mastodon https://threataft.com/articles/openspug-spug-cve-2026-108540-file-transfer-rce

Source on GitHub