CVE-2026-108546

Name of the Vulnerable Software and Affected Versions Spotweb versions prior to 1.5.9

Description An OS command injection issue exists in the runcommand NZB handler. Remote attackers can execute arbitrary commands by publishing spots over Usenet with malicious titles containing shell metacharacters. These characters are substituted unescaped for the $SPOTTITLE variable and passed to the exec() function when a user downloads the spot, resulting in the execution of commands with the privileges of the Spotweb PHP process.

Recommendations Update Spotweb to a version newer than 1.5.8.