CVE-2026-49481

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49481
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49481.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49481
Aliases
  • GHSA-6mc7-6948-w5h4
Published
2026-08-12T23:08:45.158Z
Modified
2026-08-15T11:31:00.645873771Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
Details

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wakecmd and shutdowncmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap hosted server. Version 5.4.0 patches the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49481.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/seriousm4x/upsnap

Affected ranges

Type
GIT
Repo
https://github.com/seriousm4x/upsnap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
92f9e295d5f761d874a6701245b2e38dc42cb85a
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.0"
        }
    ]
}

Affected versions

3.*
3.0.0
3.0.0-beta.10
3.0.0-beta.4
3.0.0-beta.5
3.0.0-beta.6
3.0.0-beta.7
3.0.0-beta.8
3.0.0-beta.9
3.0.1
3.0.2
3.0.3
3.0.4
3.0.4-beta.1
3.0.4-beta.2
3.0.4-beta.3
3.0.5
3.0.6
3.1.0
3.1.0-beta.1
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.3.0
3.3.0-beta.1
3.3.0-beta.2
3.3.0-beta.3
3.3.0-beta.4
3.3.1
3.3.2
4.*
4.0.0
4.0.0-beta.1
4.0.0-beta.2
4.0.0-beta.3
4.0.0-beta.4
4.0.0-beta.5
4.0.0-beta.6
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.7-beta.1
4.1.0
4.1.0-beta.1
4.1.0-beta.2
4.1.1
4.1.2
4.1.2-beta.1
4.1.2-beta.2
4.1.3
4.1.4
4.2.0
4.2.1
4.2.1-beta.1
4.2.1-beta.2
4.2.10
4.2.11
4.2.12
4.2.13-beta.2
4.2.13-beta.3
4.2.13-beta.4
4.2.13-beta.5
4.2.13-beta.6
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.2.9
4.2.9-beta.1
4.2.9-beta.2
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.4.0
4.4.0-beta.1
4.4.0-beta.2
4.4.0-beta.3
4.4.1
4.4.2
4.4.2-beta.1
4.4.2-beta.2
4.5.0
4.5.1
4.6.0
5.*
5.0.0
5.0.0-beta.1
5.0.0-beta.2
5.0.0-beta.3
5.0.1
5.0.1-beta.1
5.0.1-beta.2
5.0.2
5.0.3
5.0.4
5.0.5
5.0.5-beta.1
5.0.6
5.0.7
5.0.8
5.1.0
5.1.1
5.1.10-beta.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-beta.0
5.2.0-beta.1
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.3.0
5.3.0-beta.0
5.3.1
5.3.2
5.3.2-beta.0
5.3.3
5.3.4
5.3.5
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.4.0
v1.4.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.3.1
v2.3.2
v3.*
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.0-beta.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49481.json"