EUVD-2026-96778
GHSA-wv44-gq26-hmfv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySend crafted request to /exec/transfer
-
ExploitInject shell metacharacters into command
-
ExecutionExecute arbitrary OS commands
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Spug web application and a valid low-privileged authenticated session (CVSS PR:L), after which a request to the /exec/transfer endpoint of the File Transfer component carries attacker-controlled input into an OS command. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is reliable against affected versions up to 3.4.0/4.0.1. The primary limiting factor is the authentication requirement - anonymous internet-wide exploitation is not indicated by the vector - and the absence of a confirmed vendor patch means mitigation currently depends on access restriction rather than upgrade. |
| Impact | This is a credible, actionable priority rather than a paper-tiger high-CVSS issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high confidentiality, integrity and availability impact yields 8.6, and the CWE-78 OS command injection in the /exec/transfer File Transfer endpoint maps directly to full remote code execution on the Spug host. Exploit code has been published (SECWG GitHub issue), and the E:P (Proof-of-Concept) exploit-maturity flag in the vector corroborates POC availability - these are two independent signals of the same fact, not of active exploitation. Key tempering factors: the vector requires PR:L, so the attacker needs at least low-privileged authenticated access, which narrows the threat to users who can reach an account on the platform; and the vendor was unresponsive to disclosure, meaning no official patch is confirmed. No EPSS score and no CISA KEV listing are present in the input, so real-world exploitation volume cannot be quantified and should not be assumed widespread. The subsequent-system impact flags (SC:H/SI:H/SA:H) in the 4.0 vector appear generous for an in-host command injection and may overstate cross-system scope - treat with mild skepticism pending independent analysis. |
| Exploit ScenarioDerived | A low-privileged authenticated user of a Spug deployment sends a crafted request to the /exec/transfer File Transfer endpoint, embedding shell metacharacters in a parameter that is passed unsanitized to an OS command. The injected command executes with the privileges of the Spug service account, giving the attacker remote code execution on the host. Public exploit code for this flaw already exists, lowering the barrier to real-world abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 11, 2026
OS command injection in the open-source OpenSpug Spug operations platform (affected versions through 3.4.0 and 4.0.1) allows an authenticated, low-privileged remote user to execute arbitrary operating-system commands on the host by sending crafted input to the /exec/transfer endpoint of the File Transfer component. Exploitation is low-complexity and requires no user interaction, but it does require a valid session against the Spug web interface (CVSS PR:L), so exposure is limited to attackers who already hold a low-privileged account rather than anonymous internet users. Publicly available exploit code exists (published rating E:P) and there is no CISA KEV entry indicating confirmed active exploitation, while the vendor was contacted and did not respond, leaving no vendor-released patch identified at time of analysis.
Earlier versions of this analysis (1)
Authenticated command injection in OpenSpug Spug through 3.4.0 and 4.0.1 allows remote low-privilege users to execute arbitrary OS commands via the File Transfer component's /exec/transfer function. The flaw (CWE-78) requires network access and valid credentials, but once authenticated an attacker can fully compromise confidentiality, integrity, and availability of the host. Publicly available exploit code exists, and the vendor has not released a patch or responded to disclosure.
RemediationAI
No vendor-released patch is identified at time of analysis - the vendor did not respond to the disclosure (https://vuldb.com/vuln/416195, https://vuldb.com/submit/948328) - so remediation must currently rely on compensating controls until an upstream fix appears; monitor the openspug/spug repository and the VulDB entry for a corrected release and re-apply it as soon as one is published. The most effective interim control is to reduce reachability and privilege: place the Spug web interface behind a reverse proxy or firewall rule that allowlists only trusted administrative source networks (side effect: legitimate remote operators lose access outside those networks), and review all Spug accounts so that only staff who genuinely require file-transfer rights retain them, since the attack is only reachable with a valid low-privileged session (PR:L). Where file transfer is not operationally required, restrict or disable the File Transfer component for non-administrative roles, accepting the trade-off that deployment and file-distribution workflows performed through Spug will break. Additional hardening: deploy a WAF or reverse-proxy rule that rejects requests to /exec/transfer containing shell metacharacters (pipes, semicolons, backticks, $(), &&, redirection) - this is bypassable and should not be treated as a fix - and enable process-level monitoring/EDR alerting for unexpected shell or child processes spawned by the Spug application worker, which is the reliable detection point once the injection succeeds. Because the exploit is public (https://github.com/SECWG/CVE/issues/10), assume that any authenticated low-privileged user can trivially reproduce it, and treat credential hygiene and session revocation for the Spug console as urgent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-78 OS command injection in the File Transfer feature of Spug, an open-source operations/automation platform that provides a browser-based console for host management, deployment and file movement. In this case the /exec/transfer handler takes attacker-controlled input and composes an operating-system command from it without adequate neutralization - typically by concatenating a user-supplied path, filename or transfer parameter into a shell invocation rather than using an argument-vector API with strict allowlisting and quoting - so shell metacharacters survive into the executed command and are interpreted by the underlying shell. The CPE record (cpe:2.3:a:openspug:spug:*:*:*:*:*:*:*:*) is unversioned, meaning the CPE dictionary does not constrain the vulnerable range; the description identifies 3.4.0/4.0.1 as the affected ceiling, so earlier releases should be assumed vulnerable until a fix is published and back-ported. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, with High Confidentiality/Integrity/Availability impacts and High subsequent-system impacts SC:H/SI:H/SA:H) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) agree that a single authenticated request yields full command execution with total loss of confidentiality, integrity and availability on the Spug host - and, because command execution is as the application user, potentially on any managed hosts reachable with its credentials.
Know when Spug gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote endpoint reachable over network (AV:N) with low complexity; requires an authenticated low-privilege account (PR:L); command injection yields full host RCE, so C/I/A:H with scope unchanged (S:U) as execution stays within the host.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
CWE-78 (OS Command Injection).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The open-source Spug operations platform (versions through 3.4.0 and 4.0.1) contains an OS command injection flaw, CVE-2026-108540, that lets any user holding a valid low-privileged account run arbitrary operating-system commands on the Spug host through its File Transfer component. Because Spug is typically the system that holds administrative credentials and deployment access to the servers it manages, a single compromised or malicious low-privilege account can become a pivot point into the broader server estate. Leadership should care because publicly available exploit code exists, the vendor has not responded and no patch is available, leaving exposure management entirely in the hands of internal teams until a fix or replacement emerges.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly limit Spug web interface access to trusted networks or VPN, disable the File Transfer component and the /exec/transfer endpoint where not required, apply WAF or reverse-proxy filtering on that endpoint, reduce and review the set of accounts with Spug access, rotate credentials Spug holds for managed hosts, segment the Spug host from production systems, and enable alerting on unexpected command execution and file-transfer activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB