CVE-2026-49481

Received Received - Intake

OS Command Injection in UpSnap Prior to 5.4.0

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap hosted server. Version 5.4.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-49481

Affected Vendors & Products

Vendor	Product	Version / Range
upsnap	upsnap	to 5.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

UpSnap versions before 5.4.0 have an OS command injection flaw in device management. Unsafe shell command templates use user-controlled ip and mac fields without sanitization. This allows authenticated users to inject commands via wake_cmd and shutdown_cmd, which execute via /bin/sh -c (Linux) or cmd /C (Windows). This results in remote code execution (RCE) on the hosted server.

Detection Guidance

Check for unauthorized command execution attempts in system logs, particularly for /bin/sh -c or cmd /C commands. Inspect UpSnap device configurations for suspicious ip or mac field values containing shell metacharacters or commands. Monitor network traffic for unexpected outbound connections from the UpSnap server.

Impact Analysis

An attacker with low privileges can execute arbitrary OS commands on the UpSnap server. This could lead to full system compromise, data theft, or unauthorized access to sensitive information. The impact depends on server permissions and network access.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health information privacy). Compliance may be compromised if sensitive data is exposed or altered due to the RCE risk.

Mitigation Strategies

Upgrade UpSnap to version 5.4.0 or later immediately. Restrict user permissions to prevent low-privileged users from creating or editing devices. Review and remove any unauthorized device entries in UpSnap. Implement network segmentation to limit potential lateral movement if exploitation occurs.

Hi! I’m here to help you understand CVE-2026-49481. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70