CVE-2026-53932: Laravel Backup Restore RCE Vulnerability

CVE-2026-53932 Overview

CVE-2026-53932 is an OS command injection vulnerability [CWE-77] in laravel-backup-restore, a package that restores database backups created with spatie/laravel-backup. Versions prior to 1.9.4 fail to properly validate entries inside backup archives before passing paths to shell commands during database restore. An attacker who can supply a crafted backup archive can inject arbitrary operating system commands that execute in the context of the application. Maintainer Stefan Zweifel released version 1.9.4 with hardened ZIP entry validation.

Critical Impact
A crafted backup archive triggers OS command injection during the restore workflow, giving attackers arbitrary command execution on the host running the Laravel application.

Affected Products

stefanzweifel/laravel-backup-restore versions prior to 1.9.4
Laravel applications integrating laravel-backup-restore with spatie/laravel-backup
Any restore workflow accepting externally sourced backup archives

Discovery Timeline

2026-09-04 - CVE-2026-53932 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-53932

Vulnerability Analysis

The flaw lives in the decompression and restore pipeline of laravel-backup-restore. When the package processes a backup archive, it extracts entries from the ZIP file and later constructs shell commands referencing the extracted dump file paths. Before version 1.9.4, the package did not validate individual ZIP entry names against the expected extraction directory. An attacker who controls the archive contents can smuggle entries whose names contain shell metacharacters or traversal sequences, which are then concatenated into a command string executed by the restore routine.

Because the restore action invokes database client binaries such as mysql or pg_restore through the OS shell, unsanitized filename components are interpreted as command syntax rather than opaque file paths. This maps to [CWE-77] Improper Neutralization of Special Elements used in a Command.

Root Cause

The root cause is missing validation of ZIP archive entries against the destination extraction path. The fix in commit a73f6c3 adds an iteration over every entry in the archive and calls a new validateZipEntry() helper before extractTo() is invoked. Without this check, entry names supplied by an attacker propagate directly into filesystem operations and downstream shell invocations.

Attack Vector

Exploitation requires an authenticated user with permission to trigger a restore, and user interaction to submit or select the crafted archive. Attack complexity is low and the vector is reachable over the network in typical Laravel admin workflows. Successful exploitation yields code execution as the PHP process user, compromising confidentiality, integrity, and availability of both the application and its database.

php

// Patch: src/Actions/DecompressBackupAction.php
$zip->setPassword($pendingRestore->backupPassword);

for ($i = 0; $i < $zip->numFiles; $i++) {
    $entryName = $zip->getNameIndex($i);
    if ($entryName !== false) {
        $this->validateZipEntry($entryName, $pathToFileToDecompress);
    }
}

spin(function () use ($pathToFileToDecompress, $extractTo, $zip) {
    $extractionResult = $zip->extractTo($extractTo);
    $zip->close();
// Source: https://github.com/stefanzweifel/laravel-backup-restore/commit/a73f6c3dfd57c5efbc46cce4e93ed033bedce8b0

The added loop validates every ZIP entry name against the intended decompression path before extraction proceeds, preventing malicious filenames from reaching the restore command builder.

Detection Methods for CVE-2026-53932

Indicators of Compromise

Unexpected child processes of the PHP-FPM or artisan worker spawning shells such as /bin/sh -c during or after a restore job.
Backup archives containing entry names with shell metacharacters (;, |, `, $() or path traversal sequences (../).
Restore log entries referencing dump file paths that do not match the expected {disk}/{backup-name}/ structure.
New or modified files outside the configured extraction directory following a restore operation.

Detection Strategies

Inventory Composer dependencies across Laravel projects and flag any stefanzweifel/laravel-backup-restore release lower than 1.9.4.
Instrument the restore action to log every ZIP entry name prior to extraction and alert on anomalous characters.
Monitor process telemetry for database client binaries (mysql, pg_restore, sqlite3) invoked with unusual argument patterns.

Monitoring Recommendations

Forward Laravel queue and scheduler logs to a central data lake and correlate restore events with process execution telemetry.
Track outbound network connections initiated by PHP worker processes immediately after restore jobs, which can indicate post-exploitation activity.
Baseline normal restore durations and payload sizes so that abnormally large or slow restores trigger review.

How to Mitigate CVE-2026-53932

Immediate Actions Required

Upgrade stefanzweifel/laravel-backup-restore to version 1.9.4 or later using composer update stefanzweifel/laravel-backup-restore.
Restrict the restore command and any admin routes that trigger it to trusted operators only.
Audit recent restore jobs and review associated process and filesystem activity for signs of exploitation.

Patch Information

The fix is delivered in GitHub Release v1.9.4 via Pull Request #116 and commit a73f6c3. Full details are published in GitHub Security Advisory GHSA-w9mx-xmg4-gc4r.

Workarounds

Only restore backup archives produced by trusted spatie/laravel-backup pipelines under your control, and reject externally supplied archives.
Run the restore worker under a dedicated low-privilege OS account with no shell and no write access outside the backup directory.
Enforce integrity checks (signed hashes) on backup archives before invoking the restore action.

bash

# Upgrade to the patched release
composer require stefanzweifel/laravel-backup-restore:^1.9.4
composer show stefanzweifel/laravel-backup-restore | grep versions