UBUNTU-CVE-2026-108546

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-108546

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108546.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-108546

Upstream

CVE-2026-108546

Published

2026-10-10T15:16:00Z

Modified

2026-10-17T10:01:22Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.

References

Affected packages

Ubuntu:18.04:LTS / spotweb

Package

Name: spotweb
Purl: pkg:deb/ubuntu/spotweb?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

Other

20130826+dfsg3-4

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "spotweb",
            "binary_version":  "20130826+dfsg3-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108546.json"

Ubuntu:20.04:LTS / spotweb