Description

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-04T20:17:23.570Z",
  "pubdate": "2026-09-04T20:17:23.570Z",
  "executiveSummary": "The laravel-backup-restore package is vulnerable to an OS command injection vulnerability due to improper input sanitization during the database restoration process. This flaw allows an authenticated attacker to execute arbitrary system commands on the host server by providing a maliciously crafted backup archive.\nThe vulnerability affects versions of laravel-backup-restore prior to 1.9.4. By manipulating the contents of the backup file used by the spatie/laravel-backup integration, an attacker can escape the intended restoration process and achieve remote code execution (RCE) with the privileges of the underlying web server process.\nSuccessful exploitation compromises the integrity, availability, and confidentiality of the host environment, potentially allowing the attacker to escalate privileges, pivot within the network, or exfiltrate sensitive data. This represents a critical security risk for any application utilizing this package for automated database restoration workflows.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of filenames or internal archive metadata when the package processes backups created by spatie/laravel-backup. During the restoration workflow, the application fails to adequately sanitize input derived from the backup archive before passing it to system-level calls or shell execution functions.\nThe attack flow begins when an attacker prepares a crafted backup archive. By injecting shell metacharacters (such as backticks, semicolons, or pipes) into the metadata or filenames contained within the archive, an attacker can break out of the intended execution context. When the target system processes this archive for restoration, the vulnerable component passes the unsanitized input directly into a command string executed by the OS shell.\nAs the system attempts to restore the database, the OS interprets the injected metacharacters as valid shell instructions. This allows the attacker to execute arbitrary commands, effectively bypassing application logic. The vulnerability does not require complex memory corruption techniques, as it relies on the direct concatenation of user-controlled input into a shell command execution function.\nThe impact of this injection is severe, as the command is executed with the system permissions assigned to the Laravel application process. This facilitates full control over the application's runtime environment, the ability to read or modify database contents, and the potential to facilitate lateral movement within the network infrastructure.\nThe vulnerability is specific to the package logic in versions prior to 1.9.4. The exploitation requires the attacker to have the capability to upload or provide a backup file that the application will subsequently process, typically necessitating an authenticated session with administrative or file-management privileges. There is no evidence that this vulnerability is exploitable via unauthenticated network requests alone, unless the application exposes an upload endpoint for database backups that lacks proper access control."
}