CVE-2026-108546: Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Spotweb installations through 1.5.8 that use the runcommand NZB handler are exposed when a user downloads a malicious spot. The injected command runs with the privileges of the Spotweb PHP process.
What does an attacker need to do to exploit it?
The attacker can publish a self-signed spot over Usenet whose title contains shell metacharacters. Exploitation requires a user to download that spot so its title is substituted for $SPOTTITLE and passed to exec().
Does exploitation require authentication or user interaction?
The attacker does not need privileges in the affected Spotweb instance. However, exploitation requires user interaction: a user must download the malicious spot.
What can be done if patching is not immediately possible?
The provided information identifies the runcommand NZB handler as the affected component. Disabling or avoiding that handler prevents the described path in which $SPOTTITLE is passed unescaped to exec().