CVE-2026-65711— sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1505 · Server Software ComponentGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-65711
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
Source: CVE Program / CVE List V5
Vulnerability Description
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
nuxsmin sysPass 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
nuxsmin sysPass是nuxsmin个人开发者的一款密码管理软件。 nuxsmin sysPass 3.2.11及之前版本存在命令注入漏洞，该漏洞源于FileBackupService在构建tar shell命令时通过字符串拼接插入siteBackupPath设置，未使用escapeshellarg()或等效清理，导致OS命令注入，允许认证管理员通过设置恶意备份路径并触发备份来执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-65711
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-65711
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-65711 (1)
Proof of Concept for CVE-2026-65711 (1)
- 🔗 CVE-2026-65711 — sysPass OS Command Injection via Admin-Configurable Backup Path · GitHub Read full article technical-descriptionexploit
Same Patch Batch · nuxsmin · 2026-07-24 · 4 CVEs total
| CVE-2026-65709 | 8.3 HIGH | sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API |
| CVE-2026-65708 | 8.1 HIGH | sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController |
| CVE-2026-65710 | 7.1 HIGH | sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption |
IV. Related Vulnerabilities
V. Comments for CVE-2026-65711
No comments yet