CVE-2026-90770 in Spug
Tóm tắt
Bởi VulDB • 13/09/2026
Spug up to version 3.4.0 contains a remote code execution (RCE) vulnerability in the `ping_check` function, which interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the `/monitor/run_test/` endpoint to execute arbitrary commands as the Spug process user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.