Prior to 0.23.0, the Kopia HTTP server, when run with the --without-password flag, exposes the /api/v1/repo/exists endpoint without authentication. An unauthenticated client can provide an SFTP storage configuration that sets externalSSH to true and includes a malicious sshArguments string containing an -oProxyCommand option. Kopia forwards that configuration to blob.NewStorage, which then invokes exec.CommandContext("ssh") with the supplied command line. Because the command is executed by OpenSSH on the host that runs the Kopia HTTP server, an attacker can inject arbitrary shell commands, yielding remote code execution. The vulnerability was addressed in version 0.23.0, which removes the ability to inject a ProxyCommand via the storage configuration.

Vulnerable versions are all releases of the Kopia backup tool from kopia:kopia prior to version 0.23.0, which is available and Linux. Any installation running the HTTP server with the --without-password option during this period is susceptible, regardless of the backup target platform.

The CVSS score of 9.8 reflects critical severity. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation at this time. Kopia is not listed in the CISA KEV catalog. An attacker can achieve remote code execution simply by sending a crafted request to the exposed HTTP endpoint while the server is running with --without-password. No additional prerequisites are required beyond the HTTP server being reachable.