VulnSocial

CVE-2026-108540

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-77CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 1 mentions (2026-10-10); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-10-10: 1Mentions · 2026-10-11: 110-1010-11
Referenced assets1 URL
By indicator
Full discourse2 posts
  • ThreatAft@ThreatAft

    CVE-2026-108540 | CVSS 9.9 OpenSpug Spug /exec/transfer — OS command injection, public PoC, no patch, vendor silent. https://threataft.com/articles/openspug-spug-cve-2026-108540-file-transfer-rce #CVE #CyberSecurity #OpenSpug #RCE #CommandInjection

    0001021
    49 followersView on X
  • VulDB 🛡@vuldb

    ⚠️ We have just added an important vulnerability affecting OpenSpug Spug (CVE-2026-108540) vuldb.​com/vuln/416195 https://t.co/9opjlttPT6

    00001106
    2.3K followersView on X

Explore more

Back to dashboard