OpenSpug Remote Command Injection: Unpatched Critical CVE-2026-108540 Affects Versions 3.0-4.0.1 With No Vendor Fix

A critical remote code execution vulnerability in OpenSpug Spug’s File Transfer component allows attackers to inject operating system commands. The flaw affects versions up to 3.4.0 and 4.0.1, with no confirmed patch from the vendor as of the NVD record publication.

What happened

The National Vulnerability Database recorded CVE-2026-108540, identifying an OS command injection vulnerability within OpenSpug Spug. This flaw resides in an unknown function of the /exec/transfer file within the File Transfer component. The NVD assigns the issue a CVSS v3.1 score of 9.4, classifying it as Critical, although one record lists it as High at 8.6. The weakness stems from improper neutralisation of special elements, mapped to CWE-78 and CWE-77.

Affected software versions include OpenSpug Spug 3.0, 3.1, 3.2, 3.3, and up to 3.4.0 or 4.0.1. The vulnerability allows for remote exploitation, meaning an attacker does not need physical access to the target system. Public exploit code has been published, significantly increasing the risk of automated scanning and weaponised attacks. The vendor was contacted early regarding this disclosure but provided no response or remediation guidance.

Why it matters

Organisations using OpenSpug for IT operations management face immediate risk from unauthenticated remote code execution. Attackers leveraging the published exploit can take full control of the underlying server hosting the application. This compromises the confidentiality, integrity, and availability of assets managed through the platform. The lack of vendor response leaves administrators without an official mitigation path, forcing reliance on compensating controls.

Exposure to critical command injection flaws often leads to lateral movement within networks. Since the exploit is public, threat actors can easily integrate it into botnets or ransomware delivery frameworks. CISOs must treat this as an urgent operational risk, as the window between discovery and widespread exploitation is narrowing rapidly. The absence of a patch means the vulnerability persists in all deployed instances of the affected versions.

Next steps

• Inventory all systems running OpenSpug Spug to identify affected versions 3.0 through 3.4.0 and 4.0.1.
• Verify if public exploit code is actively scanning your network perimeter using intrusion detection systems.
• Assess the ability to isolate the application from external networks until a vendor update is available.
• Review access logs for the /exec/transfer endpoint for signs of malicious command injection attempts.

What to do and how to stay safe: OpenSpug

• Isolate affected OpenSpug instances from untrusted networks to prevent remote exploitation.
• Monitor web server logs for unusual activity targeting the /exec/transfer endpoint.
• Implement strict network segmentation to limit lateral movement if a server is compromised.
• Await an official patch from the vendor before restoring full external access to the application.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which OpenSpug versions are vulnerable to CVE-2026-108540?

Versions 3.0, 3.1, 3.2, 3.3, and up to 3.4.0 or 4.0.1 are affected by the remote command injection flaw.

Has the vendor released a patch for this vulnerability?

No fix has been confirmed; the vendor did not respond to early disclosure attempts according to the NVD record.

Is there public exploit code for this vulnerability?

Yes, the exploit has been published and may be used by attackers to launch remote code execution attacks.