Vulnerability details
CVE-2026-49481
seriousm4x UpSnap
UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
CVSS 3.1
9.6Critical
Official description
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap hosted server. Version 5.4.0 patches the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.6Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| seriousm4x | UpSnap | < 5.4.0 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-6mc7-6948-w5h4 x_refsource_CONFIRM
- https://github.com/seriousm4x/UpSnap/releases/tag/5.4.0 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-13
- Last updated
- 2026-08-13
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
1.48%
Probability of exploitation in 30 days
74.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')