CVE-2026-63725 in sysPass
Summary
by MITRE • 08/07/2026
sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() and no validation of the path against a safe character set. The $this->path value is read from the sysPass configuration, which is persisted in the database and writable through the admin settings API and the admin UI. An administrator (or an attacker who has obtained an admin API token or admin session) can therefore store a backup path containing shell metacharacters and trigger a backup operation to execute arbitrary OS commands as the web server process user (typically www-data or apache). Because sysPass is a password manager whose sole purpose is to hold credentials for other systems, code execution as the web-server user permits reading sysPass's master password and encryption key from memory or configuration files, decrypting every stored credential in the database, exporting the entire password vault, pivoting to internal systems using the disclosed credentials, and installing persistent backdoors on the password-manager host.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified in sysPass's FileBackupService::doBackupFiles() represents a critical command injection flaw that stems from improper input sanitization and shell command construction within the application's backup functionality. This issue resides in lib/SP/Services/Backup/FileBackupService.php at approximately line 388 where the system constructs a tar command by directly concatenating user-supplied path data into the shell execution context without any form of escaping or validation. The vulnerable code pattern demonstrates a classic lack of proper input sanitization, creating an environment where maliciously crafted backup paths can be exploited to execute arbitrary operating system commands through PHP's exec() function.
The technical implementation of this vulnerability occurs when the $this->path variable, which originates from sysPass configuration data stored in the database, gets directly incorporated into a shell command string without proper escaping mechanisms such as escapeshellarg(). This design flaw is particularly dangerous because the configuration path value can be modified through the application's administrative API or user interface, allowing an attacker with administrative privileges to inject shell metacharacters into the backup directory path. The absence of validation against safe character sets further compounds the risk by permitting any potentially malicious input to traverse into the shell command execution context.
The operational impact of this vulnerability extends far beyond simple command injection, as it provides attackers with complete control over the password manager's host system. When an administrator or attacker triggers a backup operation with a maliciously crafted path, the web server process executes arbitrary commands with the privileges of the web server user typically running as www-data or apache. This privilege level allows for extensive access to the application's sensitive data including master passwords, encryption keys, and all stored credentials that the password manager maintains. The implications are severe because sysPass serves as a centralized credential repository, making this vulnerability a prime target for attackers seeking to gain access to multiple systems and establish persistent footholds within organizational networks.
Security standards such as CWE-78 and CWE-88 directly apply to this vulnerability, categorizing it as a command injection flaw where untrusted data flows into shell commands without proper sanitization. The ATT&CK framework would classify this as privilege escalation through application exploitation followed by lateral movement using stolen credentials, potentially leading to persistence mechanisms and credential harvesting. The vulnerability's exploitation path aligns with ATT&CK technique T1059.001 (Command and Scripting Interpreter: Shell Script) and T1566 (Phishing: Spearphishing Attachment), as attackers could leverage administrative access or stolen tokens to trigger the vulnerable code path.
Mitigation strategies for this vulnerability should include immediate implementation of proper shell argument escaping using escapeshellarg() on all user-supplied path values before command construction, along with comprehensive input validation against known safe character sets. The application architecture should be redesigned to avoid direct shell command construction from user data, instead implementing safer alternatives such as native PHP tar libraries or proper API calls that don't require shell execution. Additionally, administrative privileges should be strictly limited to verified users only, and all configuration modifications should undergo strict input validation and sanitization processes. Regular security auditing of input handling mechanisms and implementation of automated vulnerability scanning tools can help prevent similar issues in future code development cycles.