OS command injection in UpSnap device management (wake_cmd/shutdown_cmd) (CVE-2026-49481)

An OS command injection vulnerability exists in UpSnap's device management functionality due to unsafe shell command template interpolation of the `ip` and `mac` fields. User-controlled values are inserted into `wake_cmd` and `shutdown_cmd` templates and executed via `/bin/sh -c` (Linux) or `cmd /C` (Windows) without sanitization. A low-privileged authenticated user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap server. Affected versions: - <=5.3.5 We recommend updating to: >= 5.4.0. CVSS 9.6 · our assessment: act_now Reference: https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-6mc7-6948-w5h4 Details: https://vuln.today/cve/CVE-2026-49481