CVE-2026-49481: UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wakecmd and shutdowncmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap hosted server. Version 5.4.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UpSnapto a version that resolves this vulnerability.Fixed in 5.4.0 - Compensating control
Restrict access to the UpSnap device management functionality (create/edit devices) so only trusted, authorized users can modify fields that feed into wake_cmd/shutdown_cmd template interpolation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49481?
CVE-2026-49481 has a critical severity rating of 9.6.
How do I fix CVE-2026-49481?
To fix CVE-2026-49481, upgrade to UpSnap version 5.4.0 or later.
What type of vulnerability is CVE-2026-49481?
CVE-2026-49481 is an OS command injection vulnerability.
What can be exploited in CVE-2026-49481?
CVE-2026-49481 can be exploited via Remote Code Execution through unsafe command template interpolation.
Which functionality of UpSnap is affected by CVE-2026-49481?
The device management functionality of UpSnap is affected by CVE-2026-49481.