Is CVE-2026-63725 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63725 being exploited in the wild.

How severe is CVE-2026-63725?

High severity, with a CVSS score of 7.2, published 6 August 2026.

Which products and versions are affected?

Syspass v3.x (all versions, including 3.2.11).

Is there a fix for CVE-2026-63725?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-63725 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63725?

Check whether you run Syspass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63725: sysPass FileBackupService OS command injection

CVE-2026-63725 · Severity: high · CVSS 7.2 · Published 2026-08-06

sysPass is a web-based password manager used to securely store credentials for other systems. An administrator can inject arbitrary shell commands into the backup path configuration, which are executed when a backup operation is triggered. This allows an attacker with admin access to execute code as the web server user, read the master encryption key, decrypt all stored passwords, and compromise every credential in the vault.

Technologies: Syspass. Vendors: Syspass.

Quick answers

Is CVE-2026-63725 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63725 being exploited in the wild.
How severe is CVE-2026-63725?: High severity, with a CVSS score of 7.2, published 6 August 2026.
Which products and versions are affected?: Syspass v3.x (all versions, including 3.2.11).
Is there a fix for CVE-2026-63725?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63725 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63725?: Check whether you run Syspass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in FileBackupService::doBackupFiles() at lib/SP/Services/Backup/FileBackupService.php line 388. The vulnerable code builds a tar shell command by string-concatenating the backup path ($this->path) directly into the command line without calling escapeshellarg() or validating the path. The $this->path value is read from the database and writable via the admin API or UI. An administrator can store a malicious backup path containing shell metacharacters (`;`, backticks, `$()`, etc.), which are interpreted by the shell when exec() is called. Successful exploitation grants arbitrary code execution as the web server process user (www-data or apache), permitting decryption of the entire password database and lateral movement using compromised credentials. The project appears abandoned with no patch available (last release v3.2.11 on 2022-07-02).

Affected products

sysPass sysPass v3.x (all versions, including 3.2.11)

Timeline

2026-07-22: disclosed
2026-08-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.