CVE-2026-63725 is an authenticated OS command injection vulnerability in sysPass, an open-source password manager used to store credentials for other systems.
The backup service constructs a shell command using an administrator-configurable backup path without adequate escaping or validation. An attacker with admin access, or with a compromised admin session or API token, can influence that path and trigger backup execution to run arbitrary commands as the web-server user.
Because sysPass holds high-value secrets, host-level code execution can expose vault material and enable lateral movement. Limit administrative access, isolate the application network surface, and follow the official CVE record for status and remediation guidance.