CVE-2026-108546
Description
A flaw was found in Spotweb. An unauthenticated remote attacker can achieve arbitrary command execution on the underlying server. This issue occurs because spot titles are not properly sanitized before being passed into system execution functions within the runcommand handler. When a user downloads a maliciously crafted spot, the injected commands execute with the permissions of the Spotweb service process.
Statement
This vulnerability is rated as having an Important severity because successful exploitation enables remote attackers to execute arbitrary commands under the privileges of the hosting web service, leading to potential full compromise of the application environment. Exploitation requires user interaction to download an item and is dependent on the application being configured to use an external command execution handler. Red Hat product offerings do not include or distribute Spotweb, and supported products are not affected by this flaw.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
