CVE-2026-65711

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12

Description Authenticated administrators can execute arbitrary commands as the web server process user by configuring a malicious backup path and triggering a backup. The FileBackupService constructs a tar shell command using string concatenation, incorporating the siteBackupPath variable without proper sanitization via escapeshellarg() or similar methods before passing it to the exec() function. This allows injected commands to persist and execute during every subsequent backup operation.

Recommendations Update sysPass to a version newer than 3.2.11. As a temporary mitigation, avoid modifying the siteBackupPath setting and restrict access to the backup functionality.