Skip to content
Threat Feed
Subscribe

Product

Spug (<= 4.0.1)

1 brief RSS
critical advisory

CVE-2026-108540: Remote Command Injection in OpenSpug Spug

OpenSpug Spug versions 3.4.0, 4.0.1, and earlier contain a remote OS command injection vulnerability in the File Transfer component, which is currently subject to public exploit availability.

Spug +1 web-vulnerability remote-code-execution
2t 1c