CVE-2026-108540

CriticalCVSS 9.9/10Last modified Oct 14, 2026

Description

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Oct 11, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1085416.3A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefCVE-2026-1085426.3A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/inCVE-2026-1085436.3A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgenCVE-2026-1085446.3A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewCVE-2026-1085455.9SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resourCVE-2026-1085467.5Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute cCVE-2026-1085476.5AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenantsCVE-2026-1085487.3AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer CVE-2026-1085498.1cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go thaCVE-2026-108554.3An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, thCVE-2026-1085508.8SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows autheCVE-2026-1085519.8openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to i