CVE-2026-108540

Name of the Vulnerable Software and Affected Versions OpenSpug Spug versions 3.x through 3.4.0 OpenSpug Spug versions 4.x through 4.0.1

Description A flaw in the File Transfer component allows remote attackers to perform OS command injection via a manipulation of the /exec/transfer endpoint. OS command injection is a technique where an attacker executes arbitrary operating system commands on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /exec/transfer endpoint to minimize the risk of exploitation.