CVE-2026-63725
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
sysPass in FileBackupService::doBackupFiles() builds a tar command by concatenating the backup directory path without escapeshellarg() and without character validation. An administrator (or an attacker with an API token) can store a path containing shell metacharacters, and when a backup is triggered, arbitrary OS commands can be executed as the web server user. This can lead to reading the master password and encryption key, decrypting all stored passwords, and compromising the system.
Risk Assessment
Code execution on the password manager server allows theft of all stored credentials, potentially leading to privilege escalation and compromise of the entire infrastructure.
Recommendation
Update sysPass to a patched version. Restrict access to the admin panel and API, and validate backup paths.
Other vulnerabilities in sysPass
See all- CVE-2026-65711High
OS command injection vulnerability in sysPass up to version 3.2.11, allowing authenticated administrators to execute arbitrary commands by setting a malicious backup path and triggering a backup.
- CVE-2026-65710High
Missing authorization vulnerability in sysPass up to version 3.2.11, allowing authenticated users with the PUBLICLINK_CREATE flag to trigger unauthorized decryption and persistent storage of any vault account's password.
- CVE-2026-65709High
Missing object-level authorization in the JSON-RPC API in sysPass up to version 3.2.11, allowing API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control.
- CVE-2026-65708High
Insecure direct object reference vulnerability in sysPass up to version 3.2.11, allowing any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for.
Original NVD description (English source)
sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() and no validation of the path against a safe character set. The $this->path value is read from the sysPass configuration, which is persisted in the database and writable through the admin settings API and the admin UI. An administrator (or an attacker who has obtained an admin API token or admin session) can therefore store a backup path containing shell metacharacters and trigger a backup operation to execute arbitrary OS commands as the web server process user (typically www-data or apache). Because sysPass is a password manager whose sole purpose is to hold credentials for other systems, code execution as the web-server user permits reading sysPass's master password and encryption key from memory or configuration files, decrypting every stored credential in the database, exporting the entire password vault, pivoting to internal systems using the disclosed credentials, and installing persistent backdoors on the password-manager host.