CVE-2026-53932

Name of the Vulnerable Software and Affected Versions laravel-backup-restore versions prior to 1.9.4

Description An OS command injection can occur during the database restore process when handling a crafted backup archive. The restore workflow extracts a ZIP archive and identifies files under db-dumps, converting the dump path to an absolute path. This path is then interpolated into shell command strings for database import without being shell-escaped. Specifically, the issue affects commands such as mysql, gunzip, psql, and sqlite3 when processed via the IlluminateSupportFacadesProcess::run(string) function, which utilizes Symfony Process::fromShellCommandline(). Consequently, shell metacharacters within the dump filename are interpreted by the system shell, allowing an attacker to execute arbitrary shell commands as the PHP/Laravel application user. This can lead to application compromise, disclosure of database credentials, and tampering with restored data.

Recommendations Update laravel-backup-restore to version 1.9.4.