CVE-2026-65711
HighCVSS 7.2Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
OS command injection vulnerability in sysPass up to version 3.2.11, allowing authenticated administrators to execute arbitrary commands by setting a malicious backup path and triggering a backup.
Risk Assessment
An attacker administrator can gain full control over the web server, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update sysPass to a version containing the fix or apply proper input sanitization.
Other vulnerabilities in sysPass
See all- CVE-2026-63725High
sysPass in FileBackupService::doBackupFiles() builds a tar command by concatenating the backup directory path without escapeshellarg() and without character validation. An administrator (or an attacker with an API token) can store a path containing shell metacharacters, and when a backup is triggered, arbitrary OS commands can be executed as the web server user. This can lead to reading the master password and encryption key, decrypting all stored passwords, and compromising the system.
- CVE-2026-65710High
Missing authorization vulnerability in sysPass up to version 3.2.11, allowing authenticated users with the PUBLICLINK_CREATE flag to trigger unauthorized decryption and persistent storage of any vault account's password.
- CVE-2026-65709High
Missing object-level authorization in the JSON-RPC API in sysPass up to version 3.2.11, allowing API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control.
- CVE-2026-65708High
Insecure direct object reference vulnerability in sysPass up to version 3.2.11, allowing any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for.
Original NVD description (English source)
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.