Executive brief
sysPass is a web-based password manager used to securely store credentials for other systems. An administrator can inject arbitrary shell commands into the backup path configuration, which are executed when a backup operation is triggered. This allows an attacker with admin access to execute code as the web server user, read the master encryption key, decrypt all stored passwords, and compromise every credential in the vault.
Technical details
The vulnerability is an OS command injection (CWE-78) in FileBackupService::doBackupFiles() at lib/SP/Services/Backup/FileBackupService.php line 388. The vulnerable code builds a tar shell command by string-concatenating the backup path ($this->path) directly into the command line without calling escapeshellarg() or validating the path. The $this->path value is read from the database and writable via the admin API or UI. An administrator can store a malicious backup path containing shell metacharacters (`;`, backticks, `$()`, etc.), which are interpreted by the shell when exec() is called. Successful exploitation grants arbitrary code execution as the web server process user (www-data or apache), permitting decryption of the entire password database and lateral movement using compromised credentials. The project appears abandoned with no patch available (last release v3.2.11 on 2022-07-02).
Affected products
- sysPass sysPass v3.x (all versions, including 3.2.11)
Timeline
- 2026-07-22: disclosed
- 2026-08-06: advisory