CVE-2026-49481: UpSnap Wake on LAN App RCE Vulnerability

CVE-2026-49481 Overview

CVE-2026-49481 is an OS command injection vulnerability [CWE-78] in UpSnap, an open-source wake-on-LAN web application. Versions prior to 5.4.0 interpolate user-controlled ip and mac device fields directly into the wake_cmd and shutdown_cmd shell templates. UpSnap executes these templates via /bin/sh -c on Linux or cmd /C on Windows without sanitization. An authenticated low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the host running UpSnap. Version 5.4.0 patches the flaw.

Critical Impact
Authenticated attackers with device edit rights achieve remote code execution on the UpSnap server, leading to full host compromise.

Affected Products

UpSnap versions prior to 5.4.0
Linux deployments executing shell commands via /bin/sh -c
Windows deployments executing shell commands via cmd /C

Discovery Timeline

2026-08-12 - CVE-2026-49481 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-49481

Vulnerability Analysis

UpSnap's device management feature builds shell command strings by interpolating device attributes into configurable templates. The wake_cmd and shutdown_cmd templates accept the ip and mac fields from device records. When a device is triggered, UpSnap substitutes these values into the template and dispatches the result to the operating system shell. Because no sanitization or argument separation is applied, an attacker can embed shell metacharacters such as ;, |, &&, or backticks inside the ip or mac field. The resulting command runs with the privileges of the UpSnap process, granting remote code execution on the host.

Root Cause

The root cause is unsafe template interpolation into a shell context. UpSnap concatenates user-controlled strings into a command line, then invokes the system shell rather than executing the target binary with an argument vector. This pattern collapses the data and code boundary and matches the classic OS Command Injection weakness described in CWE-78.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit devices. The attacker submits a device record whose ip or mac value contains shell metacharacters and appended commands. When the wake or shutdown action fires, the crafted payload is passed to /bin/sh -c or cmd /C and executed. No user interaction from an administrator is required beyond normal application use. Detailed exploitation notes are available in the GitHub Security Advisory GHSA-6mc7-6948-w5h4.

Detection Methods for CVE-2026-49481

Indicators of Compromise

Device records containing shell metacharacters (;, |, &, `, $() in the ip or mac fields.
Unexpected child processes spawned by the UpSnap binary, such as sh, bash, curl, wget, nc, or powershell.
Outbound network connections from the UpSnap host to unfamiliar IP addresses immediately after a wake or shutdown action.
New or modified device entries created by low-privileged accounts that contain non-standard field values.

Detection Strategies

Monitor process ancestry for the UpSnap service and alert on any shell interpreter descendant not tied to a legitimate wake command.
Inspect UpSnap application logs for device creation and edit events, correlating field values against a strict IP and MAC address regex.
Deploy behavioral endpoint detection to flag command execution patterns originating from web application processes.

Monitoring Recommendations

Forward UpSnap audit logs and host process telemetry to a centralized SIEM for correlation and retention.
Alert on any invocation of /bin/sh -c or cmd /C by the UpSnap process where arguments contain suspicious command chaining.
Review authentication logs for accounts that gained device edit privileges shortly before anomalous host activity.

How to Mitigate CVE-2026-49481

Immediate Actions Required

Upgrade UpSnap to version 5.4.0 or later without delay.
Audit existing device records for shell metacharacters in the ip and mac fields and remove suspicious entries.
Rotate credentials for all UpSnap accounts, prioritizing users with device edit permissions.
Restrict device create and edit permissions to trusted administrators only.

Patch Information

The maintainers fixed the vulnerability in the UpSnap 5.4.0 release. Administrators should redeploy the updated container or binary and validate the patched version is running. Refer to the GitHub Security Advisory GHSA-6mc7-6948-w5h4 for advisory details.

Workarounds

If patching is not immediately possible, remove or disable the device management feature for non-administrative users.
Place UpSnap behind a reverse proxy that enforces additional authentication and network access controls.
Run UpSnap as an unprivileged system user inside a restricted container to limit blast radius if exploited.

bash

# Configuration example: pull and deploy the patched UpSnap release
docker pull ghcr.io/seriousm4x/upsnap:5.4.0
docker stop upsnap && docker rm upsnap
docker run -d --name upsnap --user 1000:1000 \
  --cap-drop=ALL --cap-add=NET_RAW \
  -p 8090:8090 ghcr.io/seriousm4x/upsnap:5.4.0