CVE-2026-108540: Remote Command Injection in OpenSpug Spug

OpenSpug Spug versions up to 3.4.0 and 4.0.1 are vulnerable to remote OS command injection via the /exec/transfer endpoint in the File Transfer component. This vulnerability allows an unauthenticated or authenticated remote attacker to execute arbitrary system commands on the underlying server hosting the application. The vulnerability has been confirmed with a CVSS v3.1 base score of 9.9, and public exploit code is currently available. As of the disclosure, the vendor has not responded to vulnerability reports, leaving instances at high risk of compromise. Defenders should prioritize limiting network access to the Spug application and monitoring for unexpected child processes originating from the application service.

Impact

Successful exploitation results in full remote code execution on the application server. This allows attackers to gain unauthorized access to the system, exfiltrate sensitive configuration data, pivot into the internal network, or deploy further malicious payloads. Given the nature of the Spug platform, which is typically used for deployment and server management, a compromise could lead to the takeover of managed infrastructure across an entire organization.

Recommendation

• Implement strict network access control lists (ACLs) to restrict access to the Spug management interface to trusted internal IP ranges.
• Monitor web server access logs for anomalous POST requests directed at the /exec/transfer endpoint.
• Monitor process creation logs for the Spug application user (e.g., www-data or spug) spawning shells or unauthorized utility processes like /bin/sh, /bin/bash, or /usr/bin/python.
• Since no patch is currently available from the vendor, consider isolating affected systems or disabling the File Transfer component if it is not strictly required.