Syspass EUVD-2026-48717

We are tasked to synthesize data about CVE-2026-65711 into a JSON object. We must use all provided data: description, CVSS (especially the CVSS:4.0 vector, note this is CVSS 4.0 not 3.1), EPSS, KEV (not mentioned, assume no KEV), POC (publicly available), CPE, tags, SSVC, ENISA references.

We need to output each field as a plain text string, not array/object.

First, parse the data:

• Description: sysPass through version 3.2.11 contains OS command injection, authenticated admins can set malicious backup path, the FileBackupService builds a tar command via string concatenation with siteBackupPath without escapeshellarg(), passing to exec(). Injected commands persist and execute on every backup trigger.
• CVSS Score: 8.6 (note this is likely a CVSS 4.0 score, not 3.1). Provided vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Interpretation: Network attack vector, Low attack complexity, No attack requirements, Privileges Required High, No user interaction, Vulnerable component confidentiality high, integrity high, availability high, subsequent system none. Environmental metrics all X (not defined). So base score 8.6 is derived from those base metrics.

• CWE: CWE-78 (OS Command Injection).
• Multi-source:

EPSS: 2.41% (percentile 82%): This is relatively high, indicating a moderate likelihood of exploitation in next 30 days. Percentile 82% means it's higher than 82% of all CVEs. POC/Exploit: Publicly available (so there is a PoC). Reported by: VulnCheck. CPE: cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:* (all versions up to 3.2.11) Tags: Command Injection, Syspass. SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. (So SSVC says PoC exists, not automatable, total technical impact.) ENISA EUVD ID: EUVD-2026-48717, affected versions: sysPass 0 ≤3.2.11. References:

• gist.github.com (exploit)
• vulncheck advisory
• NVD detail

No KEV mentioned. So it's not in CISA KEV. So exploitation status: publicly available exploit code exists, but not confirmed actively exploited by CISA.

We must produce a comprehensive analysis with all fields.

Now for each field:

1. product_name: "sysPass" (3 words? Actually one word, it's the product name)
2. summary: 2-3 sentence plain-language. Start with impact verb and product. "Authenticated OS command injection in sysPass 3.2.11 allows administrators to execute arbitrary commands..." but we need to incorporate all data. Mention that it's authenticated, the mechanism (backup path), EPSS moderate, PoC exists. Not KEV, but publicly available PoC. So:

"Authenticated command injection in sysPass up to version 3.2.11 permits administrators with configuration privileges to execute arbitrary OS commands by setting a crafted backup path. The vulnerability resides in FileBackupService's unsanitized string concatenation when building a tar command, allowing injected commands to persist across backup runs. Exploit code is publicly available, and EPSS indicates a 2.41% exploitation probability (82nd percentile)."

1. technical_context: Explain underlying technology: sysPass is a PHP-based password manager. The backup functionality uses PHP exec() to call tar, constructing the command by directly concatenating the user-supplied path. The CWE-78 is OS command injection. Use CPE to identify affected product: cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:* (all versions). Root cause is lack of escapeshellarg() or similar sanitization before passing to exec().
2. risk_assessment: Use CVSS 4.0 vector: AV:N, PR:H, AC:L, UI:N, High impact on confidentiality, integrity, availability. So it's a high-privilege, network-accessible command injection. EPSS 2.41% suggests moderate real-world exploit probability. SSVC: exploitation: PoC (public exploit), not automatable, total technical impact. So risk: It's a critical vulnerability if an admin account is compromised, but it requires high privileges, which limits attack surface unless there is another way to gain admin access. Note: CVSS score 8.6, but PR:H. So it's not a remote unauthenticated RCE; it's post-authentication. However, if admin accounts are weak or another vulnerability grants access, it's severe. The SSVC "not automatable" might indicate it's not easily scripted, but PoC exists, so manual exploitation is possible. The high score is justified given total compromise. Contrast: EPSS moderate, not extremely widespread. We'll say: While CVSS base score is high (8.6), the requirement for administrative privileges significantly reduces the risk in environments with strong admin credential management. The publicly available PoC increases urgency for patching.
3. affected_products: "sysPass versions up to and including 3.2.11 are affected. The product is identified by CPE cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:*. Vendor advisory available at VulnCheck (link)."
4. remediation: Vendor-released patch? The description says "through version 3.2.11" implying that version is vulnerable, but no mention of a fix version. The references are an exploit gist and a VulnCheck advisory. No mention of an official patch. So no vendor patch identified? But we should check: The CVE was assigned, maybe a fix is in a later version. Since the description says "through version 3.2.11", maybe 3.2.12 or 3.3.0 exists? We have no data. So we must state: No official patched version confirmed. Workaround: Since the injection is via backup path set by admin, a compensating control: restrict admin access to trusted users only; disable backup functionality if not needed; implement input validation at web application firewall (WAF) to block command injection patterns in the backup path parameter. However, the description says the path is admin-configurable, so likely only admins can set it. So limiting admin accounts is key. If patch not available, maybe monitor. But it's better to say: Upgrade to a patched version once released. As of analysis, no patched version identified. Use network segmentation to restrict access to the sysPass admin interface.
5. exploit_scenario: An attacker who obtains administrative credentials (via phishing, brute force, or another vulnerability) logs into the sysPass admin panel, navigates to the backup settings, and sets the backup path to a value like "/tmp/backup; id > /tmp/pwned". When a backup is triggered (automatically or manually), the injected command executes as the web server user, leading to full command execution and potential lateral movement.
6. exploitation_conditions: Specific conditions: The attacker must have administrative privileges to configure the backup path. The backup functionality must be enabled and triggered (manually or via scheduled task). No other special conditions: the vulnerability exists in the default code path when processing backups. The attack is remote (network), requires authentication as an admin (PR:H), no user interaction beyond setting the malicious path. So: "Requires administrative authentication to sysPass; the backup feature must be enabled and triggered. No additional non-default configurations are required."
7. attack_chain: Using kill chain, we have a 4-step: Access (obtain admin credentials or session) → Exploit (set malicious backup path via admin interface) → Execution (trigger backup, injecting command) → Impact (execute arbitrary OS commands as web user). So: "Gain administrative access to sysPass → Set malicious backup path in settings → Trigger backup operation → The injected OS command executes via exec()" Actually, the injection persists, so it's: "Gain admin access → Inject command in backup path → Wait for or trigger backup → Execute arbitrary commands". But the chain can be: "Authenticate as admin → Navigate to backup configuration → Insert shell metacharacters into backup path → Save configuration → Trigger backup → Execute command". For brevity, we can combine. So: "Obtain admin credentials → Set backup path to include command injection → Initiate backup → Malicious command executes as web server user". That's 4 steps. It's a simple chain.
8. confidence_notes: Based on data: CVE assigned, VulnCheck advisory confirms vulnerability, exploit PoC publicly available. CVSS vector provided by NVD/NIST? Actually the CVSS vector came with the data, likely from NVD. So confirmed by NVD. Patch status unknown; no official fix version mentioned. The CVE description states "through version 3.2.11" so likely later versions may patch it but not confirmed. So: "Vulnerability confirmed by NVD and VulnCheck advisory. Public PoC exploit exists. No patched version identified in available data."
9. prevalence: sysPass is a self-hosted password manager, not as widely deployed as commercial alternatives. It's likely used by small to medium organizations or individuals. So prevalence: low? Possibly medium? It's an open-source project, some enterprise use but not ubiquitous. I'd say low. However, the SSVC says "not automatable" and EPSS 2.41% indicates some scanning? I'll estimate low. But prevalence basis: "open-source password manager, niche deployment". Could be medium if commonly used, but compared to WordPress or Apache, it's low. So "low".
10. prevalence_basis: "self-hosted password manager, modest community adoption". Short.
11. assessed_cvss_vector: We need to produce our own CVSS 3.1 base vector. The provided CVSS is 4.0. We can map the 4.0 base metrics to 3.1 as best we can. CVSS 4.0 has AV:N, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H. The 3.1 equivalents: AV:N, AC:L, PR:H, UI:N, S:C? Wait, in CVSS 4.0, scope is not explicitly present; instead we have vulnerable and subsequent system metrics. The attack vector is network, complexity low, privileges high, user interaction none. For scope: in CVSS 4.0, high impact on vulnerable system, low on subsequent. But in 3.1, scope is determined by whether the vulnerable component and impacted component are the same. Here, the vulnerability is in the web application (the vulnerable component) and execution happens on the same machine, so likely the vulnerable component and the impacted component are the same. However, it might be argued that the vulnerable component is the web app, and the impact is on the underlying OS, which is a different component. Typically for command injection in web apps, CVSS 3.1 sets Scope: Changed if the web app's security context is different from the OS command. Many CVSS 3.1 vectors for command injection use S:C. But we need to be consistent. The provided 4.0 set SC:N means subsequent system (after scope change) has no impact? Wait, no: In CVSS 4.0, VC:Vulnerable component confidentiality, VI, VA are high. SC: Subsequent system confidentiality, integrity, availability are all N. This means the vulnerable component (web app) suffers high impact, while the subsequent system (maybe the OS) has none? That doesn't make sense for OS command injection. The CVSS 4.0 user guide says: Vulnerable component is the thing that contains the vulnerability; Subsequent system is the component that suffers the impact if it's different. Here, the vulnerable component is the web application (sysPass). The impact is on the OS where commands are executed. If the web app and OS are considered separate, then the vulnerable component (web app) might have no confidentiality, integrity, availability impact because the exploit doesn't alter the web app itself, but rather the OS. But the injection lets an attacker execute commands as the web server user, which could read files (confidentiality), modify files (integrity), or disrupt service (availability) on the OS. The web app's own data may be accessible too. I think traditional CVSS 3.1 would set Scope Changed and impact on the OS as the target, with Conf/Integ/A