Spug vulnerabilities

2 known vulnerabilities in Spug from OpenSpug. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  Spug: Improper Neutralization of Special Elements used in a Command

  CVE-2026-108540Oct 11, 2026OpenSpugEPSS 1.7%

  A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit ha

• 8.8 High severity

  spug: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-90770Sep 13, 2026OpenSpugEPSS 1.32%

  Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metach