Back to Vulnerability Research

CVE-2026-63725

sysPass Authenticated OS Command Injection via Backup Path

High · CVSS 4.0 8.6VulnChecksysPassCWE-78
Published
August 6, 2026
Affected versions
3.0.0 through 3.2.11
Researchers
Reju Kole
View on CVE.org

CVE-2026-63725 is an authenticated OS command injection vulnerability in sysPass, an open-source password manager used to store credentials for other systems.

The backup service constructs a shell command using an administrator-configurable backup path without adequate escaping or validation. An attacker with admin access, or with a compromised admin session or API token, can influence that path and trigger backup execution to run arbitrary commands as the web-server user.

Because sysPass holds high-value secrets, host-level code execution can expose vault material and enable lateral movement. Limit administrative access, isolate the application network surface, and follow the official CVE record for status and remediation guidance.