https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:00:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-365193 EUVD-2026-365193 https://cve.radiocsirt.org/vuln/euvd-2026-365193 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53932 <p>laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.</p> <p>laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53932 https://cve.radiocsirt.org/vuln/ghsa-w9mx-xmg4-gc4r <p><strong>Affected:</strong> Packagist: wnx/laravel-backup-restore</p> <p>## Summary A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under `db-dumps`, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings.</p> <p>The dump filename is not shell-escaped before it is interpolated into commands such as:</p> <p>- `mysql ... &lt; {dumpFile}` - `gunzip -c {dumpFile}` / `gunzip &lt; {dumpFile}` - `psql ... &lt; {dumpFile}` - `sqlite3 ... &lt; {dumpFile}`</p> <p>Because `Illuminate\Support\Facades\Process::run(string)` uses Symfony `Process::fromShellCommandline()`, shell metacharacters in the dump filename are interpreted by `/bin/sh` on Unix-like systems or by the platform shell on Windows.</p> <p>### Impact If an attacker can cause an operator or automation to restore a malicious backup archive, the attacker can execute arbitrary shell commands as the PHP/Laravel application user on the system performing the restore. This can lead to application compromise, database credential disclosure, tampering with restored data, and further lateral movement depending on deployment permissions.</p> <p>This is not about malicious SQL inside the dump. The command injection is carried in the ZIP entry filename under `db-dumps`, before the dump content is imported.</p> <p>### Patches The vulnerability has been fixed in v1.9.4 of the package.</p> <p>### Workarounds There is no configuration option that disables the vulnerable code path. Upgrading t…</p> <p><strong>Affected:</strong> Packagist: wnx/laravel-backup-restore</p> <p>## Summary A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under `db-dumps`, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings.</p> <p>The dump filename is not shell-escaped before it is interpolated into commands such as:</p> <p>- `mysql ... &lt; {dumpFile}` - `gunzip -c {dumpFile}` / `gunzip &lt; {dumpFile}` - `psql ... &lt; {dumpFile}` - `sqlite3 ... &lt; {dumpFile}`</p> <p>Because `Illuminate\Support\Facades\Process::run(string)` uses Symfony `Process::fromShellCommandline()`, shell metacharacters in the dump filename are interpreted by `/bin/sh` on Unix-like systems or by the platform shell on Windows.</p> <p>### Impact If an attacker can cause an operator or automation to restore a malicious backup archive, the attacker can execute arbitrary shell commands as the PHP/Laravel application user on the system performing the restore. This can lead to application compromise, database credential disclosure, tampering with restored data, and further lateral movement depending on deployment permissions.</p> <p>This is not about malicious SQL inside the dump. The command injection is carried in the ZIP entry filename under `db-dumps`, before the dump content is imported.</p> <p>### Patches The vulnerability has been fixed in v1.9.4 of the package.</p> <p>### Workarounds There is no configuration option that disables the vulnerable code path. Upgrading t…</p> https://cve.radiocsirt.org/vuln/ghsa-w9mx-xmg4-gc4r