Remote Code Execution Vulnerability in Spug by OpenSpug
CVE-2026-90770

8.7HIGH

Key Information:

Vendor

Openspug

Status
Spug
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90770?

Spug through version 3.4.0 contains a vulnerability in the ping_check function that allows authenticated users with monitor permissions to execute arbitrary commands on the server. By manipulating monitor address inputs via the /monitor/run_test/ endpoint, attackers can inject shell metacharacters without proper input validation, leading to unauthorized command execution as the Spug process user. This poses significant risks to the integrity and security of the affected systems.

Affected Version(s)

spug 0 <= 3.4.0

References

https://github.com/openspug/spug/issues/741
issue-tracking
https://github.com/openspug/spug
product
https://github.com/openspug/spug/blob/v3.4.0/spug_api/app...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.