Executive brief
A vulnerability in the laravel-backup-restore library, which is used to manage database backups in Laravel applications, allows for remote code execution. If an attacker provides a specially crafted backup file with a malicious filename, the system may execute unauthorized commands during the restoration process. This could lead to a full application compromise, theft of database credentials, or unauthorized access to sensitive data.
Technical details
An OS command injection vulnerability exists in laravel-backup-restore versions up to 1.9.3. The restore workflow extracts a ZIP archive and enumerates files under the 'db-dumps' directory without proper shell escaping of the filenames. These filenames are then interpolated into shell command strings for database import tools like mysql, psql, and sqlite3 via Symfony's Process::fromShellCommandline(). An attacker with the ability to provide a malicious backup archive can execute arbitrary shell commands as the web server user. The issue is fixed in version 1.9.4.
Affected products
- stefanzweifel laravel-backup-restore <= 1.9.3
Timeline
- 2026-06-02: disclosed: Initial disclosure by researcher
- 2026-07-09: advisory: GitHub Advisory published
- 2026-07-09: patched: Vulnerability fixed in version 1.9.4