Spotweb up to version 1.5.8 contains an OS command injection flaw in the Runcommand NZB handler. Malicious spot titles are inserted directly into an exec() call without escaping, enabling attackers to execute arbitrary shell commands on the server running Spotweb. This is a classic remote code execution vulnerability identified as CWE‑78.

The affected product is Spotweb by Spotweb Project, any release up to and including 1.5.8. No additional vendor data is available, but the issue resides in the file NzbHandler/Services_NzbHandler_Runcommand.php, indicating that clients using the Runcommand NZB handler are vulnerable.

The CVSS score of 7.7 signals a high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is remote, via the Usenet network: an attacker posts a self‑signed spot with a title containing shell metacharacters; when a user downloads the spot, the title is substituted into exec() and executed as the Spotweb PHP process. Successful exploitation could allow the attacker to run arbitrary commands as the Spotweb user, compromising confidentiality, integrity, and availability of the host.