CVE-2026-63725

Name of the Vulnerable Software and Affected Versions sysPass (affected versions not specified)

Description The doBackupFiles() function in FileBackupService.php constructs a tar shell command by concatenating the backup directory path this->path directly into the command line without using escapeshellarg() or validating the path against a safe character set. This result is then passed to the PHP exec() function. Since the this->path value is read from the configuration and can be modified via the admin settings API or admin UI, an administrator or an attacker with an admin session or API token can inject shell metacharacters. This allows the execution of arbitrary OS commands with the privileges of the web server process user. Such execution could lead to the exposure of the master password and encryption keys, decryption of all stored credentials, and the installation of persistent backdoors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.