PT-2026-64378 · Nuxsmin · Syspass

Saidakbarxon Maxsudxonov · CVE-2026-65711 · Published 2026-07-24 · Updated 2026-07-24

NVD

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-65711

Affected Products

Syspass

References · 3

• 🔥 https://gist.github.com/sermikr0/16bcbc799dc33d39d5714db9bbcbdb77 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-65711 · Security Note
• https://vulncheck.com/advisories/syspass-authenticated-os-command-injection-via-backup-path · Note