Executive brief
btrbk is a backup tool for Btrfs filesystems that can restrict remote SSH commands through a filter script. A flaw in the command filter's pattern matching allows attackers to append arbitrary shell commands after a legitimate btrbk backup command, gaining execution with the privileges of the backup account. This affects only deployments using ssh_filter_btrbk.sh in authorized_keys configurations.
Technical details
The ssh_filter_btrbk.sh script uses a regex pattern to validate SSH commands against an allowlist, but lacks proper end-of-string anchoring in the stream_out_match regex. An attacker with SSH access can append pipe characters and additional commands after a valid btrbk prefix to bypass the filter. The vulnerability requires SSH forced-command configuration and affects btrbk versions 0.29.0 through 0.32.6.
Affected products
- digint btrbk 0.29.0 through 0.32.6
Timeline
- 2026-09-18: disclosed
- 2026-07-19: patched: Version 0.32.7 released with fix