CVE-2026-65711

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65711
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65711.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65711
Published
2026-07-24T16:12:57Z
Modified
2026-10-28T02:31:15Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
Details

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65711.json"
}
References

Affected packages

Git / github.com/nuxsmin/syspass

Affected ranges

Type
GIT
Repo
https://github.com/nuxsmin/syspass
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
9d0e169d2163897238877fb65130db47fe1ddcfa
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "3.2.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

1.*
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.2.18
1.1.2.19
1.1.2.20
1.1.2.21
1.1.2.22
1.1.2.23
1.1.2.24
1.2.0.02-rc2
1.2.0.03-rc3
1.2.0.04-rc4
1.2.0.05-rc5
1.2.0.06
1.2.0.07
1.2.0.08
1.2.0.09
1.2.0.10
1.2.0.11
1.2.0.12
1.2.0.13
1.2.0.14
1.2.0.16
1.2.0.17
1.2.0.18
1.2.0.19
1.2.0.20
1.2.0.21
2.*
2.0.0.17021301
2.0.0.17021302
2.0.0.17021601
2.1.0.17022601
2.1.0.17030201
2.1.1.17030601
2.1.10.17053003
2.1.11.17061503
2.1.12.17080701
2.1.13.17083101
2.1.14.17090101
2.1.15.17101701
2.1.16.18061901
2.1.2.17031401
2.1.3.17031601
2.1.4.17032801
2.1.5.17041201
2.1.6.17041401
2.1.7.17042101
2.1.8.17042901
2.1.9.17050401
3.*
3.0.0.18126201
3.0.1
3.0.1.19012002
3.1.0.19042801-rc1
3.1.0.19043001-rc2
3.1.0.19052502-rc3
3.1.0.19052503-rc4
3.1.0.19072001-rc5
3.1.0.19081801
3.1.1.19121601
3.1.2.20030701
3.2.0
3.2.1
3.2.10
3.2.11
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65711.json"