CVE-2026-65711: sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sysPassto a version that resolves this vulnerability.Fixed in 3.2.11 - Configuration
Update sysPass to address the OS command injection; additionally, configure siteBackupPath to a benign absolute directory path because the vulnerability occurs when FileBackupService inserts siteBackupPath into a tar shell command without escapeshellarg()/sanitization.
sysPass FileBackupService siteBackupPath = Set to a safe, non-malicious filesystem path (no shell metacharacters) and do not accept untrusted input - Compensating control
Restrict authenticated administrator access to the backup-trigger function and the ability to modify siteBackupPath so only trusted admins can initiate backups with potentially malicious paths.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65711?
The severity of CVE-2026-65711 is classified as high with a CVSS score of 8.6.
How do I fix CVE-2026-65711?
To fix CVE-2026-65711, upgrade to sysPass version 3.2.12 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2026-65711?
CVE-2026-65711 is classified as an OS command injection vulnerability.
Who is affected by CVE-2026-65711?
Authenticated administrators using sysPass versions through 3.2.11 are affected by CVE-2026-65711.
What can attackers achieve with CVE-2026-65711?
Attackers can execute arbitrary commands as the web server process user through the authenticated OS command injection.