CVE-2026-108546 Details

A command injection vulnerability has been identified in Spotweb versions through 1.5.8. This issue resides within the runcommand NZB handler, where remote attackers can execute arbitrary commands by publishing spots with malicious titles containing shell metacharacters. When a user downloads the spot, these characters are unescaped and injected into a command that is executed by the Spotweb PHP process. The vulnerability exploits the trust between the Usenet spot title and the command execution process, leading to unauthorized command execution on the server.

The vulnerability can be fixed by escaping the spot title and the NZB file path with 'escapeshellarg()' before substituting them into the command. This prevents the injection of malicious commands by treating the title as a safe, single-quoted argument. Additionally, the integration could be revised to use a command argument vector without a shell, ensuring that user data is never directly interpolated into a shell command.