Command Injection in sysPass via FileBackupService

CVE-2026-63725 is a command injection vulnerability affecting the sysPass password management software. The vulnerability originates in the FileBackupService::doBackupFiles() method located in lib/SP/Services/Backup/FileBackupService.php. The application improperly handles the $this->path variable, which stores the backup directory path, by concatenating it directly into a tar command string passed to PHP's exec() function without sanitization via escapeshellarg(). Because the backup path is a configurable setting stored in the database and accessible via the admin API or UI, an attacker with administrative privileges can inject arbitrary shell metacharacters. Upon triggering a backup operation, these metacharacters are executed in the context of the web server process (e.g., www-data or apache). As sysPass contains sensitive credentials and encryption keys, successful exploitation grants the attacker full control over the password vault, potential lateral movement into managed systems, and the ability to establish persistent access on the host.

Impact

Successful exploitation results in full compromise of the sysPass instance. As a password manager, the application stores critical credentials and encryption keys; an attacker can decrypt the entire database, exfiltrate all stored passwords, pivot to managed internal environments using those credentials, and deploy web shells or other backdoors on the host server to maintain persistence.

Recommendation

• Apply the vendor-provided patch to lib/SP/Services/Backup/FileBackupService.php to ensure the backup path is correctly sanitized using escapeshellarg() before string concatenation.
• Audit administrative account activity and API token usage to detect unauthorized modifications to sysPass configuration settings.
• Restrict administrative access to the sysPass web interface and API to a limited set of known-good IP addresses or via an authenticated VPN.