CVE-2026-108546CWE-78command-injection

CVE-2026-108546

High · published October 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
56.2
In the wild
Unconfirmed
What it is

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00803 · 56.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-10T19:16Z
References (4)
https://github.com/spotweb/spotweb · [email protected]https://github.com/spotweb/spotweb/blob/1.5.8/lib/services/NzbHandler/Services_NzbHandler_Runcommand.php#L41-L45 · [email protected]https://hackmd.io/@haind/spotweb-runcommand-title-injection · [email protected]https://www.vulncheck.com/advisories/spotweb-through-1.5.8-os-command-injection-via-spot-title-in-runcommand-integration · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 1%
    epss
  • 10 OCT 14:15Z
    Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
    cvelistv5
  • 10 OCT 14:15Z
    Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
    cvelistv5