OpenSpug Spug: OS command injection in file transfer
Summary
A flaw in the File Transfer function (/exec/transfer) of OpenSpug Spug allows OS command injection through manipulated request parameters. According to the researcher, an attacker with a low-privileged account that has file distribution rights can run commands on the Spug server and, from there, on every managed host. A public proof of concept exists, and the vendor did not respond to the disclosure.
Affected
- OpenSpug Spug 3.0, 3.1, 3.2, 3.3, 3.4.0, 4.0.0 and 4.0.1 (as listed by CVE/VulDB; the exact range is unclear)
Fixed in
Unknown. No fixed version has been published.
Workaround
- No vendor workaround known.
- Do not expose Spug to the internet; restrict access to trusted IP addresses or a VPN.
- Limit file distribution permissions to the minimum needed.
Exploitation
- Public proof of concept available (VulDB status: Proof-of-Concept).
- No evidence of exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation poc, not automatable.
- EPSS about 1.7%.
Our recommendation
- Inventory all Spug instances and their versions.
- Take internet-exposed instances offline or restrict them to a VPN or allow-listed IPs immediately.
- Review and reduce accounts with file distribution rights.
- If the instance was exposed, check the Spug server and managed hosts for signs of compromise.
- Monitor the openspug/spug repository and NVD for a fix; plan migration or isolation if none appears.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub SECWG/CVE Issue #10 github.com
- VulDB CVE-2026-108540 vuldb.com
- VulDB vuln 416195 vuldb.com
- OpenCVE CVE-2026-108540 app.opencve.io
- Vulners CVE-2026-108540 vulners.com
- Strix CVE-2026-108540 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:02.
Original description (NVD)
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.