CVE-2026-53932

wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')

View on CVE.org
Published Sep 4, 2026 CVSS 3.1 · 8 High EPSS 1.7% KEV · Not listed
Description
laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.

Analysis

AI-generated

Technical impact

A maliciously crafted backup archive can cause the laravel-backup-restore tool to execute arbitrary commands, allowing an attacker to run code with the privileges of the application. The vulnerability resides in the lack of proper sanitization of special characters before they are interpolated into an OS command, classified as CWE-77 and CWE-78. If exploited, the attacker can compromise confidentiality, integrity, and availability of the affected system.

Affected Systems

The flaw is present in the stevanzweifel/laravel-backup-restore package before version 1.9.4. Any deployment that uses laravel-backup-restore 1.9.3 or earlier, when restoring a backup archive supplied by an attacker, is vulnerable.

Risk and Exploitability

The CVSS score of 8 indicates a high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a crafted backup file that the application processes during a restore operation, which could be delivered via a web interface or manually on the server. Successful exploitation results in full remote code execution.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to versio n 1.9.4 or later of laravel-backup-restore to eliminate the unsafe command construction.
  • Validate and sanitize backup archives before feeding them to restoration code, ensuring that any data used in command strings is strictly controlled.
  • Restrict the execution of restore functionality to a restricted user role or network segment, and run the restoration process with the least privileges necessary.

Generated by OpenCVE AI on September 4, 2026 at 21:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-w9mx-xmg4-gc4r laravel-backup-restore has an OS Command Injection during database restore
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Stefanzweifel
Stefanzweifel laravel-backup-restore
Vendors & Products Stefanzweifel
Stefanzweifel laravel-backup-restore
Type Values Removed Values Added
Description laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.
Title wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')
Weaknesses CWE-77
CWE-78
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Sep 8, 2026, 4:57 PM
Reserved
Jun 11, 2026, 3:46 PM

View source JSON

Updated
Sep 8, 2026, 4:41 PM

JSON

Status
Awaiting Analysis
Published
Sep 4, 2026, 8:17 PM
Modified
Sep 10, 2026, 8:41 PM

View source JSON

No data.

Updated
Sep 7, 2026, 8:25 AM

JSON