openspug Spug command injection vulnerability

Openspug Spug versions 3.0, 3.1, 3.2, 3.3, 3.4.0, 4.0.0, and 4.0.1 have command injection vulnerabilities. These vulnerabilities stem from the unknown functions of the File Transfer component, which fail to properly validate inputs when executing operations related to the /exec/transfer function...

PT-2026-109730

Name of the Vulnerable Software and Affected Versions OpenSpug Spug versions 3.x through 3.4.0 OpenSpug Spug versions 4.x through 4.0.1 Description A flaw in the File Transfer component allows remote attackers to perform OS command injection via a manipulation of the /exec/transfer endpoint. OS...