The vulnerability resides in sysPass's FileBackupService::doBackupFiles(), where the backup directory path is concatenated directly into a shell command executed via PHP exec() without sanitization. An attacker with administrative privileges can set a backup path containing shell metacharacters and trigger a backup operation, leading to arbitrary OS command execution as the web‑server process. This allows full compromise of the password manager, including reading the master password, decrypting stored credentials, exporting the vault, pivoting to other internal systems, and installing persistent back‑doors.

The affected product is nuxsmin:sysPass, a web‑based password manager. The CVE description does not specify any particular version; therefore any installation that enables the FileBackupService and has an administrator who can modify the backup path from the UI or API is potentially vulnerable.

The CVSS score is 8.6, indicating a high‑severity vulnerability. The EPSS score is not available, and the issue is not currently listed in CISA's KEV catalog. Exploitation requires authenticated administrative access; an administrator or an unauthenticated attacker who has obtained an admin API token can inject a malicious backup path, trigger the backup process, and execute arbitrary commands. Because the commands run as the web‑server user, the attacker can read sensitive configuration files and memory, e.g., the master password, and further compromise internal systems.