Which versions of sysPass are affected by CVE-2026-63725?

sysPass, a self-hosted password vault serving as a central credential repository, can be exploited by compromised administrator accounts to expose all stored passwords across the organization.

How to fix or mitigate CVE-2026-63725?

Within 24 hours, restrict sysPass access to the absolute minimum set of administrators; disable the backup service entirely if operationally feasible; and preserve audit logs of all backup operations for forensic review. Within 7 days, implement network segmentation to prevent sysPass from initiating outbound connections to production systems, and configure enhanced alerting on all administrator authentication and backup triggers. Within 30 days, initiate migration to an alternative password management solution with superior access controls and audit capabilities (such as HashiCorp Vault or 1Password Enterprise), and execute full credential rotation across all systems currently managed through sysPass once the new solution is operational.

sysPass CVE-2026-63725

Q: What is the CVSS score of CVE-2026-63725?

CVE-2026-63725 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54210 HIGH

OS Command Injection (CWE-78)

2026-08-06 disclosure@vulncheck.com

GHSA-cqxp-cq56-pxvr

PHP RCE Apache Command Injection Hashicorp

8.6

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Admin authentication required (PR:H), network-accessible admin interface (AV:N), trivial post-auth exploitation (AC:L), full CIA impact on sysPass host with no scope change in base metrics.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 22:49 vuln.today

CVE Published

Aug 06, 2026 - 22:18 cve.org

HIGH 8.6

DescriptionCVE.org

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() and no validation of the path against a safe character set. The $this->path value is read from the sysPass configuration, which is persisted in the database and writable through the admin settings API and the admin UI. An administrator (or an attacker who has obtained an admin API token or admin session) can therefore store a backup path containing shell metacharacters and trigger a backup operation to execute arbitrary OS commands as the web server process user (typically www-data or apache). Because sysPass is a password manager whose sole purpose is to hold credentials for other systems, code execution as the web-server user permits reading sysPass's master password and encryption key from memory or configuration files, decrypting every stored credential in the database, exporting the entire password vault, pivoting to internal systems using the disclosed credentials, and installing persistent backdoors on the password-manager host.

AnalysisAI

Command injection in sysPass's backup service allows any authenticated administrator to execute arbitrary OS commands as the web server process user by storing shell metacharacters in the backup path configuration setting and triggering a backup operation. Because sysPass is a self-hosted password manager, successful exploitation grants direct read access to the master encryption key and entire credential vault, enabling mass credential disclosure and lateral movement to every system whose passwords are stored in sysPass. A public proof-of-concept is available via the referenced gist (https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279); no CISA KEV listing was identified at time of analysis.

Technical ContextAI

sysPass is a self-hosted PHP password manager (https://github.com/nuxsmin/sysPass). The vulnerability resides in lib/SP/Services/Backup/FileBackupService.php at approximately line 388 within the doBackupFiles() method. The method constructs a tar shell command via direct string concatenation, embedding the $this->path configuration value - read from the database - directly into the command string as: 'tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude "' . $this->path . '" 2>&1'. This concatenated string is then passed to PHP's exec() with no application of escapeshellarg() or escapeshellcmd() and no allowlist validation of safe characters. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause class. Because the backup path is a persisted configuration value writable through both the admin UI and admin settings API, any admin-level principal can pre-position the malicious value and detonate it at will by triggering a backup job.

RemediationAI

No vendor-released patched version has been confirmed from the provided intelligence; patch availability must be verified directly against the sysPass GitHub repository at https://github.com/nuxsmin/sysPass, specifically looking for commits that apply escapeshellarg() to $this->path in lib/SP/Services/Backup/FileBackupService.php. Until a patch is applied, immediately audit and revoke any admin API tokens that are not strictly necessary, since token holders can exploit this without UI interaction. Restrict network access to the sysPass admin interface and settings API to a trusted management VLAN or localhost only, removing the remote attack surface while preserving local admin capability. Configure the sysPass web server process to run as a dedicated low-privilege system user with no shell access and minimal filesystem permissions, so that injected commands execute with the least possible capability. Setting PHP's disable_functions directive to include exec would block exploitation of this specific vector but will also break the backup feature entirely - evaluate this trade-off against operational requirements. Do not expose the sysPass admin interface directly to the internet under any circumstances.