CVE-2026-62943 in btrbk
Summary
by MITRE • 09/18/2026
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_filter_btrbk.sh constructs allow_stream_match with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorized_keys forced command can append a trailing pipe command after a valid btrbk command prefix, bypassing the allowlist and executing arbitrary commands with the privileges of the backup-target SSH account. Deployments that do not use ssh_filter_btrbk.sh in authorized_keys are not affected. This issue is fixed in version 0.32.7.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified as CVE-2024-1859 represents a critical command injection flaw within btrbk, an open-source utility designed for creating snapshots and managing remote backups of Btrfs subvolumes. This security issue specifically affects versions ranging from 0.29.0 through 0.32.7. The root cause lies in the implementation of the ssh_filter_btrbk.sh script, which is intended to enforce strict command restrictions when users connect via SSH using authorized_keys forced commands. In these vulnerable versions, the script constructs a regular expression pattern named allow_stream_match that includes a start anchor but lacks an end-of-string anchor for validating the complete command string sent by the client. This incomplete validation logic creates a significant gap in access control mechanisms, allowing attackers to manipulate the input stream beyond the intended boundaries of the allowed commands.
From a technical perspective, the absence of an end-of-string anchor means that the regular expression only verifies that the incoming command begins with one of the permitted btrbk prefixes. It does not ensure that nothing follows this prefix except for valid arguments specific to those commands. Consequently, if a user appends additional shell syntax after the allowed btrbk command, such as using pipe characters or semicolons, the validation logic will still pass because it only checks the beginning of the string. This oversight enables an attacker who has been granted limited SSH access via forced commands to execute arbitrary system commands with the privileges associated with the backup-target SSH account. The attack vector relies on the ability to inject shell metacharacters that are interpreted by the underlying shell environment rather than being treated as literal data, thereby bypassing the intended allowlist restrictions entirely.
The operational impact of this vulnerability is severe for organizations relying on btrbk for their backup infrastructure. An attacker with access to a compromised or misconfigured SSH account can escalate privileges effectively within the context of that user's permissions. This could lead to unauthorized modification or deletion of critical data, installation of malware, or use of the system as a pivot point for further network intrusion. The severity is compounded by the fact that many deployments utilize this specific filtering mechanism precisely because it provides a controlled way to allow backup operations without granting full shell access. When this control fails due to the regex flaw, the security boundary collapses, exposing sensitive backend systems and data repositories to potential exploitation.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, specifically where input validation is insufficiently strict regarding command boundaries. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, particularly subtechniques involving shell commands or pipes, which adversaries use to execute arbitrary code on compromised systems. The flaw highlights the importance of rigorous regular expression construction in security-critical scripts, ensuring that patterns enforce both start and end boundaries when validating user-supplied input against allowlists.
To mitigate this risk, organizations must immediately upgrade btrbk to version 0.32.7 or later, where the ssh_filter_btrbk.sh script has been patched to include proper end-of-string anchoring in its validation logic. For deployments that do not utilize the ssh_filter_btrbk.sh mechanism within their authorized_keys configuration, this specific vulnerability does not apply, although general SSH hardening practices should still be reviewed. Administrators should also audit existing configurations for any instances where forced commands might allow trailing shell syntax and implement additional input sanitization layers if upgrading is not immediately feasible. Regular security audits of backup scripts and strict adherence to the principle of least privilege are essential to prevent similar command injection vulnerabilities in future deployments.