A maliciously crafted backup archive can cause the laravel-backup-restore tool to execute arbitrary commands, allowing an attacker to run code with the privileges of the application. The vulnerability resides in the lack of proper sanitization of special characters before they are interpolated into an OS command, classified as CWE-77 and CWE-78. If exploited, the attacker can compromise confidentiality, integrity, and availability of the affected system.

The flaw is present in the stevanzweifel/laravel-backup-restore package before version 1.9.4. Any deployment that uses laravel-backup-restore 1.9.3 or earlier, when restoring a backup archive supplied by an attacker, is vulnerable.

The CVSS score of 8 indicates a high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a crafted backup file that the application processes during a restore operation, which could be delivered via a web interface or manually on the server. Successful exploitation results in full remote code execution.