CVE-2026-108540 is a critical (CVSS 3.1: 9.9) OS command injection flaw in the File Transfer component of OpenSpug Spug through versions 3.4.0 and 4.0.1; an exploit is public and no vendor fix is listed.
What Is It
CVE-2026-108540 affects an unknown function in the /exec/transfer file of Spug's File Transfer component. Manipulating this function can lead to OS command injection. The CNA, VulDB, classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB published the CVE on 2026-10-11. NVD lists its status as "Deferred."
Why It Matters
- Remote attack: The attack can be launched remotely over the network. Attack complexity is low and no user interaction is required (CVSS 3.1 vector
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). - Low privileges required: The attacker needs low-privileged access, so they must have some form of authenticated access.
- Scope change: The CVSS 3.1 score marks the scope as "Changed," with high confidentiality, integrity and availability impact. The CVSS 4.0 vector also rates the impact on subsequent systems as high.
- Public exploit: According to the CNA, "the exploit has been published and may be used." The CVSS 4.0 score (8.6, HIGH) records exploit maturity as Proof-of-Concept.
- Vendor unresponsive: VulDB says the vendor was contacted early about this disclosure but did not respond.
KEV status: This CVE has no CISA Known Exploited Vulnerabilities (KEV) entry in the supplied data. A public exploit exists, but KEV does not confirm active exploitation.
What's Vulnerable
- Vendor/Product: OpenSpug Spug
- Component: File Transfer (
/exec/transfer) - Affected versions: 3.0, 3.1, 3.2, 3.3, 3.4.0, 4.0.0, 4.0.1
- CPE:
cpe:2.3:a:openspug:spug:*:*:*:*:*:*:*:*
| Metric | Score | Severity |
|---|---|---|
| CVSS 3.1 (Primary) | 9.9 | CRITICAL |
| CVSS 4.0 | 8.6 | HIGH |
| CVSS 2.0 | 9.0 | HIGH |
Patch Status
The supplied source material lists no patch, fixed version or vendor advisory. The vendor did not respond to the disclosure. There is no KEV entry, so CISA has not set a required action or due date.
Organizations running affected Spug versions should check the VulDB entries below for updates. Until a fix is available, they should treat the File Transfer endpoint as exposed to a publicly known exploit.