Vulnerability · Published Jul 24, 2026 · Assigned by VulnCheck

CVE-2026-65711sysPass 3.2.11 Authenticated OS Command Injection via Backup Path

High 7.2

In plain English

A high-severity OS command injection in sysPass from nuxsmin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)2.0%top 18.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.

Affected products (as reported)

Vendor	Product	Versions
nuxsmin	sysPass	0 – through 3.2.11

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/syspass-authenticated-os-command-injection-via-backup-path third-party-advisory