Vulnerability · Published Oct 10, 2026 · Assigned by VulnCheck

CVE-2026-108546Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

High 7.5

In plain English

A high-severity OS command injection in spotweb from spotweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 43.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.

Affected products (as reported)

Vendor	Product	Versions
spotweb	spotweb	0 – through 1.5.8

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://hackmd.io/@haind/spotweb-runcommand-title-injection technical-description, exploit
https://github.com/spotweb/spotweb product
https://github.com/spotweb/spotweb/blob/1.5.8/lib/services/NzbHandler/Services_NzbHandler_Runcommand.php#L41-L45 technical-description
VulnCheck Advisory: Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration third-party-advisory