CVE-2026-13336: OS Command Injection
Published Sep 1, 2026
·Updated
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified.
Affected Software
1 affected component
Linux
Event History
Sep 1, 2026
CVE Published
via MITRE·01:27 PM
Data Sourced
via MITRE·01:27 PM
DescriptionWeakness
Frequently Asked Questions
1
Which environments should be prioritized for review?
Linux systems that restore system backups should be reviewed, especially where backup contents could be modified before restoration. The described command execution occurs when a maliciously modified backup is restored.
2
What must occur for exploitation?
An attacker needs a system backup to be maliciously modified and then restored. No further attacker access requirements or affected configuration details are provided.