CVE-2026-108540

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

CVE-2026-108540

A vulnerability exists in OpenSpug Spug up to versions 3.4.0/4.0.1 within the File Transfer component. The flaw impacts an unknown function of the /exec/transfer file, where improper neutralization of special elements allows for os command injection . This vulnerability can be triggered via a rem...

CVE-2026-108540 OpenSpug File Transfer transfer os command injection

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

CVE-2026-108540 OpenSpug File Transfer transfer os command injection

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

EUVD-2026-96778

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

CVE-2026-108540: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

openspug Spug command injection vulnerability

Openspug Spug versions 3.0, 3.1, 3.2, 3.3, 3.4.0, 4.0.0, and 4.0.1 have command injection vulnerabilities. These vulnerabilities stem from the unknown functions of the File Transfer component, which fail to properly validate inputs when executing operations related to the /exec/transfer function...

PT-2026-109730

Name of the Vulnerable Software and Affected Versions OpenSpug Spug versions 3.x through 3.4.0 OpenSpug Spug versions 4.x through 4.0.1 Description A flaw in the File Transfer component allows remote attackers to perform OS command injection via a manipulation of the /exec/transfer endpoint. OS...