https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:43:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338334 EUVD-2026-338334 https://cve.radiocsirt.org/vuln/euvd-2026-338334 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45695 <p>Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia&#39;s HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=&lt;cmd&gt; can cause exec.CommandContext(&#34;ssh&#34;) to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.</p> <p>Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia&#39;s HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=&lt;cmd&gt; can cause exec.CommandContext(&#34;ssh&#34;) to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45695 https://cve.radiocsirt.org/vuln/ghsa-2q4c-3mrw-63c3 <p><strong>Affected:</strong> Go: github.com/kopia/kopia</p> <p>## Summary</p> <p>Kopia&#39;s HTTP server, when started with `--without-password `, accepts unauthenticated requests to `/api/v1/repo/exists`. The handler forwards an attacker-supplied storage configuration to `blob.NewStorage`. For SFTP backends with `externalSSH: true`, that path constructs a process command line by splitting `sshArguments` on spaces and passes the result directly to `exec.CommandContext(&#34;ssh&#34;)`. An `-oProxyCommand=&lt;cmd&gt;` token in `sshArguments` causes OpenSSH to invoke `&lt;cmd&gt;` via `$SHELL -c` before any TCP connection is attempted, giving the requester arbitrary command execution as the Kopia process user.</p> <p>## Analysis</p> <p>[`internal/server/server_authz_checks.go` lines 61–73](https://github.com/kopia/kopia/blob/v0.22.3/internal/server/server_authz_checks.go#L61-L73):</p> <p>when the server is started without `--server-username` or `--server-password`, `getAuthenticator()` returns `nil` and `requireUIUser` unconditionally authorizes the request. Every endpoint registered through `handleUIPossiblyNotConnected` becomes accessible without credentials.</p> <p>[`repo/blob/sftp/sftp_storage.go` lines 448–468](https://github.com/kopia/kopia/blob/v0.22.3/repo/blob/sftp/sftp_storage.go#L448-L468):</p> <p>`opt.SSHArguments` is populated from the JSON request body (`storage.config.sshArguments`). The string is split only on the literal ASCII space character, there is no shell style tokenizer, no quote handling, and no allowlist. Whatever tokens the caller supplies are appended to the `ssh` argv.…</p> <p><strong>Affected:</strong> Go: github.com/kopia/kopia</p> <p>## Summary</p> <p>Kopia&#39;s HTTP server, when started with `--without-password `, accepts unauthenticated requests to `/api/v1/repo/exists`. The handler forwards an attacker-supplied storage configuration to `blob.NewStorage`. For SFTP backends with `externalSSH: true`, that path constructs a process command line by splitting `sshArguments` on spaces and passes the result directly to `exec.CommandContext(&#34;ssh&#34;)`. An `-oProxyCommand=&lt;cmd&gt;` token in `sshArguments` causes OpenSSH to invoke `&lt;cmd&gt;` via `$SHELL -c` before any TCP connection is attempted, giving the requester arbitrary command execution as the Kopia process user.</p> <p>## Analysis</p> <p>[`internal/server/server_authz_checks.go` lines 61–73](https://github.com/kopia/kopia/blob/v0.22.3/internal/server/server_authz_checks.go#L61-L73):</p> <p>when the server is started without `--server-username` or `--server-password`, `getAuthenticator()` returns `nil` and `requireUIUser` unconditionally authorizes the request. Every endpoint registered through `handleUIPossiblyNotConnected` becomes accessible without credentials.</p> <p>[`repo/blob/sftp/sftp_storage.go` lines 448–468](https://github.com/kopia/kopia/blob/v0.22.3/repo/blob/sftp/sftp_storage.go#L448-L468):</p> <p>`opt.SSHArguments` is populated from the JSON request body (`storage.config.sshArguments`). The string is split only on the literal ASCII space character, there is no shell style tokenizer, no quote handling, and no allowlist. Whatever tokens the caller supplies are appended to the `ssh` argv.…</p> https://cve.radiocsirt.org/vuln/ghsa-2q4c-3mrw-63c3