CVE-2026-63725

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() and no validation of the path against a safe character set. The $this->path value is read from the sysPass configuration, which is persisted in the database and writable through the admin settings API and the admin UI. An administrator (or an attacker who has obtained an admin API token or admin session) can therefore store a backup path containing shell metacharacters and trigger a backup operation to execute arbitrary OS commands as the web server process user (typically www-data or apache). Because sysPass is a password manager whose sole purpose is to hold credentials for other systems, code execution as the web-server user permits reading sysPass's master password and encryption key from memory or configuration files, decrypting every stored credential in the database, exporting the entire password vault, pivoting to internal systems using the disclosed credentials, and installing persistent backdoors on the password-manager host.

• CWE-78

• https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279
• https://github.com/nuxsmin/sysPass

Published

Aug 6, 2026

Last Modified

Aug 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63687Apache CXF's JwtRequestCodeFilter copies all claims from a s…9.1
• CVE-2026-6369An improper access control vulnerability in the canonical-li…5.5
• CVE-2026-6370Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2026-6371Improper neutralization of input during web page generation …4.8
• CVE-2026-6372Missing Authorization vulnerability in Plisio Accept Cryptoc…7.5
• CVE-2026-63720datamodel-code-generator prior to version 0.70.0 contains a …7.5
• CVE-2026-63727Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 …8.8
• CVE-2026-63728Gitleaks prior to 8.30.1 contains a template injection vulne…8.1
• CVE-2026-63729The SyncTeX parser (synctex_parser.c) shipped with TeX Live …6.8
• CVE-2026-6373Exposure of sensitive system information to an unauthorized …6.5
• CVE-2026-63730HyperDX before 2.31.0 contains a server-side request forgery…5.3
• CVE-2026-63731HyperDX before 2.31.0 contains a server-side request forgery…7.7