OpenSpug

OpenSpug Spug versions 3.4.0, 4.0.1, and earlier contain a remote OS command injection vulnerability in the File Transfer component, which is currently subject to public exploit availability.