CVE-2026-45695
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Kopia prior to 0.23.0, when the HTTP server is started with --without-password, accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage. Setting externalSSH: true and sshArguments containing -oProxyCommand=<cmd> causes exec.CommandContext("ssh") to invoke the command through OpenSSH.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary commands on the server, leading to full system compromise and potential data exfiltration.
Recommendation
Immediately upgrade Kopia to version 0.23.0 or later. If upgrading is not possible, do not start the HTTP server with the --without-password flag.
Original NVD description (English source)
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.