Description

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() and no validation of the path against a safe character set. The $this->path value is read from the sysPass configuration, which is persisted in the database and writable through the admin settings API and the admin UI. An administrator (or an attacker who has obtained an admin API token or admin session) can therefore store a backup path containing shell metacharacters and trigger a backup operation to execute arbitrary OS commands as the web server process user (typically www-data or apache). Because sysPass is a password manager whose sole purpose is to hold credentials for other systems, code execution as the web-server user permits reading sysPass's master password and encryption key from memory or configuration files, decrypting every stored credential in the database, exporting the entire password vault, pivoting to internal systems using the disclosed credentials, and installing persistent backdoors on the password-manager host.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-06T22:18:12.480Z",
  "pubdate": "2026-08-06T22:18:12.480Z",
  "executiveSummary": "A remote OS command injection vulnerability exists in sysPass within the FileBackupService::doBackupFiles() method located in lib/SP/Services/Backup/FileBackupService.php.\nThe vulnerability arises due to insecure string concatenation of the backup directory path configuration variable directly into a shell command passed to the PHP exec() function without proper sanitization or the use of escapeshellarg().\nAn authenticated attacker possessing administrative privileges, or an actor who has compromised an admin API token or administrative session, can manipulate the backup path setting within the admin UI or settings API to inject arbitrary shell metacharacters.\nUpon triggering a backup operation, the underlying operating system executes the injected commands with the privileges of the web server process user, such as www-data or apache.\nGiven that sysPass functions as an enterprise credential manager, successful exploitation severely compromises the confidentiality and integrity of the entire system.\nAn adversary achieving code execution can extract master encryption keys and configuration data, decrypt the entire stored password vault, pivot to internal systems using harvested credentials, and establish persistent backdoors on the host.\nThe risk implications are critical, as total compromise of the password vault leads to cascading security failures across all infrastructure managed by the target instance.",
  "technicalDetails": "The vulnerability resides in the FileBackupService component of sysPass, specifically inside the doBackupFiles() method defined in lib/SP/Services/Backup/FileBackupService.php around line 388.\nThe root cause is improper neutralization of special elements used in an OS command, commonly known as OS Command Injection.\nThe application constructs a tar shell command by directly concatenating the user-controlled property $this->path into the command string: 'tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1'.\nThe resulting concatenated string is subsequently passed directly to PHP's exec() function without input validation against a safe character set and without employing secure argument binding functions such as escapeshellarg().\nThe $this->path value is retrieved directly from the sysPass configuration, which is persisted within the application database and is modifiable via the administrative settings API and the administrative user interface.\nTo exploit this flaw, an attacker must first obtain administrative access or a valid administrative API token to modify the backup directory path configuration.\nThe attack flow proceeds as follows: 1) The attacker authenticates or leverages an existing administrative session or API token. 2) The attacker updates the backup path setting via the admin settings API or UI to include malicious shell metacharacters payload alongside the directory path. 3) The attacker initiates a backup operation through the application interface or automated cron task. 4) The application reads the malicious configuration value and concatenates it into the tar backup command string. 5) The execution flow reaches the exec() function, causing the underlying operating system shell to parse and execute the embedded commands alongside the intended utility.\nThe payload executes with the permissions of the web server process user, typically www-data or apache.\nPost-exploitation impact is catastrophic due to the core purpose of sysPass as a centralized password manager. An adversary can access memory or configuration files to retrieve the master password and encryption keys, perform offline decryption of the entire credential database, export stored secrets, pivot laterally to internal network resources using disclosed credentials, and deploy persistent backdoors on the host system."
}