{"vulnerability": "cve-2026-108540", "sightings": [{"uuid": "3e511f0a-19f3-4ac7-a7c8-557a2f5842b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108540", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117417219424680520", "content": "\u26a0\ufe0f We have just added an important vulnerability affecting OpenSpug Spug (CVE-2026-108540) https://vuldb.com/vuln/416195", "creation_timestamp": "2026-10-10T15:03:03.992967Z"}, {"uuid": "d86770ef-5c63-4f05-bcdc-78a11b51abfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108540", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117420872438157560", "content": "CVE-2026-108540 OpenSpug File Transfer transfer os command injection A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108540https://vuldb.com/vuln/416195https://vuldb.com/vuln/416195/ctihttps://vuldb.com/cve/CVE-2026-108540https://vuldb.com/submit/948328https://github.com/SECWG/CVE/issues/10#OpenSpug #Spug#CVE_2026_108540#bot", "creation_timestamp": "2026-10-11T06:32:04.663848Z"}, {"uuid": "265eec81-5a6a-4b95-a020-86ebbb951f31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108540", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxlfyviidh2r", "content": "CVE-2026-108540 - spug\nOpenSpug versions up to 3.4.0 and 4.0.1 have a weakness in the file transfer feature that can be tricked into running operating system commands. An attacker could exploit this from\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#spug #openspug #CVE #infosec", "creation_timestamp": "2026-10-11T06:50:05.119415Z"}, {"uuid": "4dd83682-8fdd-4b14-82e2-f3877fd03933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108540", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117421101885745239", "content": "CVE-2026-108540: CRITICAL OS command injection in OpenSpug Spug 3.0 \u2013 4.0.1. Remote attackers can execute arbitrary OS commands. Exploit code is public. Restrict access/disable vulnerable features until a patch arrives. https://radar.offseq.com/threat/cve-2026-108540-os-command-injection-in-openspug-spug-6b899c3d670ff1c9 #OffSeq #Vuln #Exploit #Infosec", "creation_timestamp": "2026-10-11T07:30:25.884264Z"}, {"uuid": "a376cb12-4b17-4ac3-9fa9-c492b41e0ec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108540", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxlib42red23", "content": "OpenSpug Spug 3.0 \u2013 4.0.1 affected by CRITICAL OS command injection (CVE-2026-108540). Remote exploit possible, code is public, no patch yet. Restrict access & monitor for vendor updates. https://radar.offseq.com/threat/cve-2026-108540-os-command-injection-in-openspug-spug-6b899c3d670ff1c9 #OffSe...", "creation_timestamp": "2026-10-11T07:30:28.273174Z"}]}