CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546

Spotweb through version 1.5.8 is vulnerable to an OS command injection vulnerability within the runcommand NZB handler . The root cause is the unescaped substitution of shell metacharacters in a spot title for the $SPOTTITLE variable, which is subsequently passed to the exec() function. Remote at...