Remote Code Execution in Spug via Command Injection

Spug, an open-source server management platform, contains a critical remote code execution vulnerability (CVE-2026-90770) in the ping_check function. The application fails to properly sanitize user-supplied monitor addresses before passing them into shell commands. This vulnerability allows an authenticated attacker possessing monitor-level permissions to trigger command injection by supplying shell metacharacters through the /monitor/run_test/ endpoint. Successful exploitation results in arbitrary code execution with the privileges of the Spug process user. Given the administrative nature of the application, this vulnerability poses a significant risk for lateral movement and full system compromise within the server environments where Spug is deployed.

Impact

Successful exploitation of CVE-2026-90770 allows an authenticated attacker to execute arbitrary commands on the underlying host. This can lead to unauthorized access to server configurations, credential theft, and full system takeover. Organizations utilizing Spug for server management are at high risk if they have allowed untrusted or compromised accounts to hold monitor-level permissions.

Recommendation

Prioritize the immediate upgrade of all Spug instances to a version released after 3.4.0 that addresses CVE-2026-90770. Monitor web server logs for suspicious requests to the /monitor/run_test/ endpoint that contain shell metacharacters such as semicolons, pipes, or command substitution sequences. Restrict access to the monitoring and administrative modules of the Spug application to trusted personnel only until the software is updated.