CVE-2026-63725

Received Received - Intake

Command Injection in sysPass FileBackupService

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() and no validation of the path against a safe character set. The $this->path value is read from the sysPass configuration, which is persisted in the database and writable through the admin settings API and the admin UI. An administrator (or an attacker who has obtained an admin API token or admin session) can therefore store a backup path containing shell metacharacters and trigger a backup operation to execute arbitrary OS commands as the web server process user (typically www-data or apache). Because sysPass is a password manager whose sole purpose is to hold credentials for other systems, code execution as the web-server user permits reading sysPass's master password and encryption key from memory or configuration files, decrypting every stored credential in the database, exporting the entire password vault, pivoting to internal systems using the disclosed credentials, and installing persistent backdoors on the password-manager host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-63725

Affected Vendors & Products

Vendor	Product	Version / Range
syspass	syspass	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in sysPass allows an attacker with admin access to inject shell commands into a backup operation. The FileBackupService builds a tar command by directly inserting a user-controlled path without proper escaping or validation. This enables arbitrary OS command execution as the web server user, potentially leading to full system compromise and exposure of all stored credentials.

Detection Guidance

Check sysPass configuration files for backup paths containing shell metacharacters like semicolons, backticks, or command substitutions. Inspect web server logs for unusual tar command executions or unexpected child processes spawned by the web server user.

Impact Analysis

If you use sysPass as a password manager, an attacker could gain control of your server, read all stored credentials, decrypt your password vault, and access other systems using those credentials. This could lead to data breaches, unauthorized access to sensitive systems, and installation of persistent malware on your server.

Compliance Impact

This vulnerability would likely violate GDPR due to unauthorized access to personal data and HIPAA due to exposure of protected health information. It demonstrates a failure to implement proper access controls and secure coding practices, potentially resulting in regulatory fines and loss of compliance certifications.

Mitigation Strategies

Immediately update sysPass to the latest patched version. Disable backup functionality if not essential. Review admin accounts for unauthorized access. Restrict write access to sysPass configuration files to only necessary personnel.

Hi! I’m here to help you understand CVE-2026-63725. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70