CVE-2026-65711 Details
Description
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.
An OS command injection vulnerability has been identified in sysPass Password Manager versions through 3.2.11. This vulnerability allows authenticated administrators to execute arbitrary commands as the web server user. The issue arises in the FileBackupService, which constructs a tar command by concatenating the user-defined backup path without proper sanitization. As a result, any injected commands are executed when the backup is triggered. Exploitation of this vulnerability could lead to unauthorized access to the sysPass database and encryption keys, with potential for persistent backdoors on the server.
The vulnerability can be remediated by applying proper sanitization to the backup path before it is used in the tar command. This can be done by using the escapeshellarg() function to escape any potentially dangerous characters. Alternatively, the exec() call can be replaced with a pure-PHP library that handles archives, such as ZipArchive or PharData, to eliminate the risk of shell injection altogether.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 24, 2026CISA-ADP
Assessed Jul 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sermikr0/16bcbc799dc33d39d5714db9bbcbdb77 | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/syspass-authenticated-os-command-injection-via-backup-path | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sysPass | <= 3.2.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 25, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |