{"id":"CVE-2026-108546","state":"PUBLISHED","title":"Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration","description":"Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.","publishedAt":"2026-10-10T14:15:52.852Z","updatedAt":"2026-10-13T18:28:41.075Z","severity":{"score":7.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["spotweb spotweb"],"affected":[{"vendor":"spotweb","product":"spotweb","packageURL":"pkg:github/spotweb/spotweb","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.5.8","versionType":"semver"}],"repo":"https://github.com/spotweb/spotweb"}],"references":["https://hackmd.io/@haind/spotweb-runcommand-title-injection","https://github.com/spotweb/spotweb","https://github.com/spotweb/spotweb/blob/1.5.8/lib/services/NzbHandler/Services_NzbHandler_Runcommand.php#L41-L45","https://www.vulncheck.com/advisories/spotweb-through-1.5.8-os-command-injection-via-spot-title-in-runcommand-integration"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/108xxx/CVE-2026-108546.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-108546","state":"PUBLISHED","datePublished":"2026-10-10T14:15:52.852Z","dateUpdated":"2026-10-13T18:28:41.075Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-10T14:06:53.765Z"},"containers":{"cna":{"title":"Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration","descriptions":[{"lang":"en","value":"Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process."}],"affected":[{"vendor":"spotweb","product":"spotweb","packageURL":"pkg:github/spotweb/spotweb","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.5.8","versionType":"semver"}],"repo":"https://github.com/spotweb/spotweb"}],"references":[{"url":"https://hackmd.io/@haind/spotweb-runcommand-title-injection","tags":["technical-description","exploit"]},{"url":"https://github.com/spotweb/spotweb","tags":["product"]},{"url":"https://github.com/spotweb/spotweb/blob/1.5.8/lib/services/NzbHandler/Services_NzbHandler_Runcommand.php#L41-L45","tags":["technical-description"]},{"url":"https://www.vulncheck.com/advisories/spotweb-through-1.5.8-os-command-injection-via-spot-title-in-runcommand-integration","name":"VulnCheck Advisory: Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-10T14:15:52.852Z"},"datePublic":"2026-10-09T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*","versionEndIncluding":"1.5.8"}]}]}],"credits":[{"lang":"en","value":"HaiND from the Post and Telecommunication Institute of Technology","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-13T18:28:15.342471Z","id":"CVE-2026-108546","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-13T18:28:41.075Z"}}]}}}