CVE-2026-65711 – sysPass 3.2.11 Authenticated OS Command Injection via Backup Path

CVE ID :CVE-2026-65711

Published : July 24, 2026, 5:17 p.m. | 32 minutes ago

Description :sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.

Severity: 8.6 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…