Reju Kole

**Name of the Vulnerable Software and Affected Versions** sysPass (affected versions not specified) **Description** The `doBackupFiles()` function in `FileBackupService.php` constructs a tar shell command by concatenating the backup directory path `this->path` directly into the command line without using `escapeshellarg()` or validating the path against a safe character set. This result is then passed to the PHP `exec()` function. Since the `this->path` value is read from the configuration and can be modified via the admin settings API or admin UI, an administrator or an attacker with an admin session or API token can inject shell metacharacters. This allows the execution of arbitrary OS commands with the privileges of the web server process user. Such execution could lead to the exposure of the master password and encryption keys, decryption of all stored credentials, and the installation of persistent backdoors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microweber CMS versions prior to 2.0.21 **Description** Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates. This occurs because the Twig environment in the `TwigView::render()` function is unsandboxed and lacks a `SandboxExtension` or `SecurityPolicy`. Malicious expressions, such as `filter('system')`, can be stored unsanitized in the database within mail template bodies, leading to automatic payload execution whenever an application event triggers a mail dispatch. **Recommendations** Update Microweber CMS to version 2.0.21 or later.