CVE-2026-108546highCWE-78

CVE-2026-108546: high-severity vulnerability in spotweb

Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Published · Updated

Follow this CVE+ Monitor spotweb

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.7epss 0.8%
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
spotweb · spotweb
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.