What is the CVSS score of CVE-2026-49481?

CVE-2026-49481 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.9%.

Which versions of UpSnap are affected by CVE-2026-49481?

UpSnap, a self-hosted Wake-on-LAN management application, contains a critical authenticated remote code execution vulnerability (CVE-2026-49481, CVSS 9.6) affecting versions before 5.4.0.

How to fix or mitigate CVE-2026-49481?

Within 24 hours: immediately audit UpSnap access logs for suspicious device creation or modification activity and restrict network access to the application to trusted IPs only via firewall. Within 7 days: complete a full inventory of all UpSnap deployments and identify instances running versions prior to 5.4.0; disable device create/edit permissions for all non-administrative users and implement input validation monitoring to detect exploit attempts. Within 30 days: monitor vendor security advisories closely for release of a patch for CVE-2026-49481; once available, prioritize upgrade to version 5.4.0 or later and verify remediation through security testing.

UpSnap CVE-2026-49481

CRITICAL

OS Command Injection (CWE-78)

2026-08-12 GitHub_M

RCE Command Injection Microsoft Upsnap

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.9 CRITICAL

Network-reachable web UI (AV:N), trivial injection (AC:L), needs a low-priv device-editing account (PR:L), no interaction (UI:N); OS command exec breaks out of the app (S:C) enabling full host C/I/A, so A:H unlike NVD's conservative A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 23:36 vuln.today

Analysis Generated

Aug 12, 2026 - 23:36 vuln.today

CVE Published

Aug 12, 2026 - 23:08 cve.org

CRITICAL 9.6

DescriptionCVE.org

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap hosted server. Version 5.4.0 patches the issue.

AnalysisAI

Authenticated remote code execution in UpSnap (a self-hosted Wake-on-LAN web app) before 5.4.0 lets any low-privileged user with device create/edit permission run arbitrary OS commands on the server. User-supplied device IP and MAC values are interpolated into the wake_cmd/shutdown_cmd shell templates and passed unsanitized to /bin/sh -c on Linux or cmd /C on Windows, giving full command execution in the app's process context. No public exploit was identified at time of analysis and it is not in CISA KEV, but the flaw is trivially triggerable at low attack complexity once an account exists; a companion setup-wizard flaw (GHSA-w4jr-728f-5jhq) can let an attacker seize the first superuser on un-provisioned public instances and chain into this RCE.

Technical ContextAI

UpSnap is an open-source (Go/PocketBase backend with a Svelte frontend) web application for waking and shutting down networked devices. Its device management feature lets operators define custom shell commands for wake and shutdown actions using {{ DEVICE_IP }} and {{ DEVICE_MAC }} placeholders, which are string-substituted with each device's stored IP and MAC before execution. Because the substituted values are concatenated directly into a shell command string and handed to /bin/sh -c (Linux) or cmd /C (Windows) rather than passed as isolated argv arguments or validated as IP/MAC formats, an attacker can embed shell metacharacters (e.g. ; | & $(...) ) in the ip or mac field. This is the textbook CWE-78 OS Command Injection root cause: untrusted input crossing into a command interpreter without neutralization. The single affected package is cpe:2.3:a:seriousm4x:upsnap (all versions prior to 5.4.0).

RemediationAI

Vendor-released patch: upgrade to UpSnap 5.4.0 (https://github.com/seriousm4x/UpSnap/releases/tag/5.4.0), which sanitizes the ip and mac values used in the wake_cmd/shutdown_cmd templates. Until you can upgrade, restrict device create/edit permission to fully trusted administrators only and audit existing device IP/MAC fields for shell metacharacters, since a malicious or compromised low-privileged account is the trigger - accepting reduced day-to-day delegation. Because a pre-5.4.0 instance that has not completed initial setup also lets an attacker claim the first superuser (GHSA-w4jr-728f-5jhq), keep any un-provisioned instance off the public network and complete setup before exposure; in 5.4.0 the first superuser is created out-of-band via a one-time link in the server console logs. As additional compensating controls, place the UpSnap web UI behind a VPN or reverse-proxy authentication and network-segment the host so command execution there cannot pivot, at the cost of added access friction for legitimate users.