CVE-2026-49481: Vulnerability in UpSnap

On 26/05/2026, a security researcher at Astra Security found a critical Remote Code Execution (RCE) vulnerability in UpSnap, a web-based wake-on-LAN(WoL). 

The root cause is an OS Command Injection vulnerability(CWE-78) that exists in UpSnap’s device management functionality due to unsafe template interpolation of the IP and MAC fields. These templates are then executed via the system shell (/bin/sh -c on Linux or cmd /C on Windows) without sanitization, escaping, or proper validation of dangerous characters (& ; | $() `). 

This results in an authenticated Remote Code Execution (RCE) vulnerability, allowing any low-privileged user with permission to create or edit devices to execute arbitrary operating system commands on the UpSnap server.

Technical Breakdown of CVE-2026-49481

CVE-2026-49481 was discovered during a manual security review of the device management and command execution functionality in UpSnap. This flaw allows authenticated attackers to achieve arbitrary remote code execution by injecting shell metacharacters into the IP or MAC fields, which are then interpreted by the shell when a Wake or Shutdown operation is triggered.

How was CVE-2026-49481 discovered?

While reviewing the source code (specifically backend/networking/wake.go and shutdown.go), our researcher noticed:

wake_cmd := device.GetString("wake_cmd")

wake_cmd = strings.ReplaceAll(wake_cmd, "{{ DEVICE_IP }}", device.GetString("ip"))

// ... similar for MAC

cmd := exec.CommandContext(ctx, shell, shell_arg, wake_cmd)

To confirm the vulnerability was exploitable, the researcher set up a test device with a malicious IP address and a custom wake command:

Wake Command: {{ DEVICE_IP }} (minimal test)

IP Field: cmd.exe /c whoami > C:\Users\Public\rce_ip.txt (on Windows)

When the Wake button was clicked, UpSnap executed the injected command through the shell, successfully writing the output of whoami to the specified file. 

Further tests with payloads like & calc.exe, etc., confirmed reliable command injection. This process revealed a clear OS Command Injection vulnerability (CWE-78), leading to the responsible disclosure and this advisory.

How to replicate the vulnerability CVE-2026-49481

1. Log in to the UpSnap web dashboard.
2. Create or edit a device:
3. Go to the Devices section.
4. Add a new device with the following values (example for Windows target using calc.exe):

Name: test-device

IP: 127.0.0.1 & calc.exe ← Injection point

MAC: 00:11:22:33:44:55 (any valid-looking MAC)

Netmask: 255.255.255.0

Other fields as needed.

5. In the device settings or global settings, set the Wake command to something like:

ping -n 1 {{ DEVICE_IP }}

6. Click the Wake button for the device

7. On a Windows host running UpSnap, calc.exe should launch.

8. The calc.exe application launches successfully, confirming RCE.

Alternative minimal test (even stronger injection):

Set Wake command to just {{ DEVICE_IP }}

Set IP to cmd.exe /c whoami > C:\Users\Public\rce.txt (Windows) or equivalent on Linux.

Impact of CVE-2026-49481

A critical Remote Code Execution (RCE) vulnerability in UpSnap versions ≤ 5.3.5 allows authenticated attackers to achieve full server compromise by injecting arbitrary operating system commands.

The flaw resides in the template substitution logic within the wake and shutdown command execution paths (primarily backend/networking/wake.go and shutdown.go).

The vulnerability could lead to 

• Full arbitrary command execution on the server as the user running UpSnap
• Complete server compromise, including installation of persistent backdoors or miners
• Reading sensitive files (configuration files, environment variables, databases)
• Exfiltration of stored device credentials and network information
• Lateral movement to other systems on the internal network
• Use of the compromised server as a pivot point for further attacks

Current Status of CVE-2026-49481

The issue was responsibly disclosed to the project maintainer. This issue can be tracked under GitHub Advisory GHSA-6mc7-6948-w5h4.

What Can You Do?

Users are strongly advised to update UpSnap to 5.4.0 or later immediately to mitigate this CVE-2026-49481. If it’s not possible due to compatibility issues, implement the following workarounds:

• Strictly validate/sanitize IP and MAC inputs.
• Avoid using custom command templates with device fields.
• Use exec.Command with separate arguments instead of shell strings
• Run UpSnap with minimal privileges (dedicated low-priv user/container).

Moreover, Astra Security helps you test for this vulnerability during a manual pentest.