CVE-2026-65711: sysPass OS Command Injection Vulnerability

CVE-2026-65711 Overview

CVE-2026-65711 is an OS command injection vulnerability [CWE-78] affecting sysPass through version 3.2.11. Authenticated administrators can execute arbitrary operating system commands as the web server process user by configuring a malicious backup path and triggering a backup operation. The flaw resides in the FileBackupService, which constructs a tar shell command through string concatenation using the admin-configurable siteBackupPath setting. Because the value is passed to exec() without escapeshellarg() or equivalent sanitization, injected commands persist in configuration and execute on every subsequent backup trigger.

Critical Impact
Authenticated administrators can achieve persistent remote code execution as the web server user, leading to full compromise of hosted credentials and secrets.

Affected Products

sysPass password manager through version 3.2.11
Deployments exposing the sysPass web interface to authenticated administrators
Web server processes executing sysPass PHP code (Apache, Nginx with PHP-FPM)

Discovery Timeline

2026-07-24 - CVE-2026-65711 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65711

Vulnerability Analysis

sysPass is a PHP-based password manager for teams. The FileBackupService component generates encrypted archives of the application database and files using the system tar binary. To build the command, the service concatenates the admin-configurable siteBackupPath value directly into a shell string and passes the result to PHP's exec() function.

An administrator with configuration access can set siteBackupPath to a value containing shell metacharacters such as ;, &&, or backticks. When the next backup runs, the shell interprets the injected payload and executes attacker-controlled commands under the web server account. Because the malicious value persists in the sysPass configuration, execution repeats on every backup trigger.

Root Cause

The root cause is missing input sanitization on the siteBackupPath setting. FileBackupService does not call escapeshellarg(), escapeshellcmd(), or perform allow-list validation before interpolating the value into the tar command. Trust is placed in the administrator role rather than in the shell boundary.

Attack Vector

Exploitation requires authenticated administrator privileges over the sysPass web interface. The attacker updates the backup path in configuration, submits the change, and triggers a backup. Because the sysPass service handles secrets, this vector is attractive to insiders and to attackers who first phish or hijack an administrator session. See the VulnCheck Security Advisory and GitHub Gist PoC Code for technical details.

// No verified exploit code is reproduced here.
// Refer to the linked VulnCheck advisory and PoC for technical specifics.

Detection Methods for CVE-2026-65711

Indicators of Compromise

Unexpected values in the sysPass siteBackupPath configuration containing shell metacharacters such as ;, |, &, $(), or backticks
Child processes of the web server user spawning shells (/bin/sh, /bin/bash) from PHP-FPM or Apache worker processes
New or modified files under the sysPass web root or backup directory following administrator configuration changes

Detection Strategies

Inspect the sysPass database configuration table for the siteBackupPath value and alert on non-path characters
Monitor PHP exec(), system(), and passthru() invocations through auditing modules or Linux audit rules on the sysPass host
Correlate administrator login events with subsequent backup triggers and unusual process trees

Monitoring Recommendations

Enable auditd rules on execve events originating from the web server user and forward to a centralized SIEM
Track outbound network connections from the sysPass host to detect reverse shells or data exfiltration attempts
Alert on modification of the sysPass configuration table by administrator accounts outside change windows

How to Mitigate CVE-2026-65711

Immediate Actions Required

Restrict administrative access to sysPass to a minimal set of trusted accounts and enforce multi-factor authentication
Audit the current siteBackupPath value and reset it to a known-safe filesystem path
Review recent backup executions and web server process logs for signs of command injection

Patch Information

At the time of publication, the advisory identifies sysPass through version 3.2.11 as affected. Consult the VulnCheck Security Advisory for the latest fix status and upgrade guidance from the sysPass project.

Workarounds

Place the sysPass administrative interface behind a VPN or IP allow-list to limit exposure of the vulnerable configuration endpoint
Run the web server process under a dedicated low-privilege user with no shell and restricted filesystem access
Apply mandatory access controls such as SELinux or AppArmor profiles that block shell execution from PHP interpreters
Validate the siteBackupPath value at the reverse proxy or WAF layer to reject shell metacharacters

bash

# Example AppArmor deny rule for PHP-FPM invoking a shell
deny /bin/sh mrix,
deny /bin/bash mrix,
deny /usr/bin/tar mrix,