CVE-2026-65711
Received Received - Intake

sysPass 3.2.11 OS Command Injection via Backup Path

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-65711
EUVD
EUVD-2026-48717

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
syspass syspass 3.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

sysPass version 3.2.11 has an OS command injection flaw. Authenticated administrators can run arbitrary commands as the web server user by setting a malicious backup path. The FileBackupService builds a tar command without proper sanitization of the backup path, allowing command injection via exec().

Detection Guidance

Check for unauthorized backup paths in sysPass configuration that include shell metacharacters or commands. Inspect the FileBackupService logs for suspicious tar command executions with appended commands. Look for unexpected processes running as the web server user during backup operations.

Impact Analysis

An attacker with admin access could execute system commands, potentially gaining full control over the server. This could lead to data theft, system compromise, or disruption of services. The impact depends on the server's privileges and network access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade sysPass to a patched version beyond 3.2.11. If immediate upgrade is not possible, disable the backup feature in sysPass configuration. Review and sanitize all user-configurable paths, especially siteBackupPath, to prevent command injection. Monitor for unauthorized command executions by the web server user.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart