CVE-2026-65711 in sysPass
Summary
by MITRE • 07/24/2026
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The sysPass authentication system through version 3.2.11 presents a critical operating system command injection vulnerability that fundamentally compromises the security posture of web applications relying on this platform. This vulnerability resides within the FileBackupService component where the application constructs shell commands through direct string concatenation rather than employing proper input sanitization mechanisms. The flaw specifically manifests when administrators configure the siteBackupPath setting, which then gets incorporated into a tar command without adequate escaping or sanitization measures before being executed via the exec() function.
The technical implementation of this vulnerability follows a well-established pattern of command injection where user-controllable input directly influences shell command construction. When an authenticated administrator sets a malicious backup path containing special shell characters such as semicolons, pipes, or backticks, these elements are not properly escaped or sanitized before being passed to the exec() function. This creates a persistent injection point that allows attackers with administrative privileges to execute arbitrary commands with the privileges of the web server process user, typically running with elevated permissions on the hosting system. The vulnerability is particularly dangerous because it leverages legitimate administrative functionality to achieve unauthorized code execution.
The operational impact of this vulnerability extends beyond simple command execution as it provides attackers with persistent access to the underlying system infrastructure. Since the malicious commands are injected into a configurable path setting that persists across backup operations, any subsequent backup trigger will execute the attacker's payload, creating a recurring attack vector. This persistence mechanism aligns with the common pattern seen in web application vulnerabilities where configuration settings become attack surfaces for command injection exploits. The vulnerability affects systems where the web server process user has sufficient permissions to access sensitive system resources, potentially enabling full system compromise including data exfiltration, privilege escalation, and lateral movement within the network infrastructure.
The security implications of this vulnerability can be analyzed through the lens of CWE-78 which specifically addresses OS Command Injection, where improper input validation allows attackers to inject shell commands. This flaw also maps to ATT&CK technique T1059.001 for command and scripting interpreter with specific focus on the execution of system commands. Organizations should immediately implement mitigations including upgrading to patched versions of sysPass, implementing proper input sanitization using escapeshellarg() or equivalent functions, and restricting administrative access to only trusted users. Additional defensive measures include monitoring backup operations for unusual patterns, implementing network segmentation to limit lateral movement capabilities, and establishing robust access controls around configuration settings that influence system command execution. The vulnerability demonstrates the critical importance of proper input validation and escaping mechanisms in preventing command injection attacks, particularly when dealing with user-controllable parameters that influence shell command construction within web applications.