What is the CVSS score of EUVD-2026-71722?

EUVD-2026-71722 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of laravel-backup-restore are affected by EUVD-2026-71722?

The laravel-backup-restore Composer package contains a vulnerability in how it processes database backup files that could allow an attacker to execute arbitrary commands on your server…. A patch is available.

How to fix or mitigate EUVD-2026-71722?

Within 24 hours: Identify all Laravel applications using laravel-backup-restore and document current package versions. Within 7 days: Update all affected applications to version 1.9.4 or later. Within 30 days: Verify backup and restore operations function correctly post-update and validate that no older versions remain in production.

laravel-backup-restore EUVD-2026-71722

| CVE-2026-53932 HIGH

Command Injection (CWE-77)

2026-07-09 https://github.com/stefanzweifel/laravel-backup-restore

GHSA-w9mx-xmg4-gc4r

PHP Command Injection Microsoft

8.0

CVSS 3.1 · Vendor: https://github.com/stefanzweifel/laravel-backup-restore

Severity by source

Vendor (https://github.com/stefanzweifel/laravel-backup-restore) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Attacker supplies the archive so needs no target privileges (PR:N), but a restore must be triggered (UI:R); trivial payload crafting (AC:L) yields full code execution as the app user (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/stefanzweifel/laravel-backup-restore).

CVSS VectorVendor: https://github.com/stefanzweifel/laravel-backup-restore

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 21:22 vuln.today

CVE Published

Jul 09, 2026 - 20:52 github-advisory

HIGH 8.0

DescriptionCVE.org

Summary

A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings.

The dump filename is not shell-escaped before it is interpolated into commands such as:

mysql ... < {dumpFile}
gunzip -c {dumpFile} / gunzip < {dumpFile}
psql ... < {dumpFile}
sqlite3 ... < {dumpFile}

Because Illuminate\Support\Facades\Process::run(string) uses Symfony Process::fromShellCommandline(), shell metacharacters in the dump filename are interpreted by /bin/sh on Unix-like systems or by the platform shell on Windows.

Impact

If an attacker can cause an operator or automation to restore a malicious backup archive, the attacker can execute arbitrary shell commands as the PHP/Laravel application user on the system performing the restore. This can lead to application compromise, database credential disclosure, tampering with restored data, and further lateral movement depending on deployment permissions.

This is not about malicious SQL inside the dump. The command injection is carried in the ZIP entry filename under db-dumps, before the dump content is imported.

Patches

The vulnerability has been fixed in v1.9.4 of the package.

Workarounds

There is no configuration option that disables the vulnerable code path. Upgrading to the patched release is the only complete fix.

AnalysisAI

OS command injection in the wnx/laravel-backup-restore Composer package (fixed in v1.9.4) allows an attacker who can get a malicious backup archive restored to run arbitrary shell commands as the Laravel application user. The restore workflow interpolates an unescaped ZIP entry filename from the db-dumps directory directly into shell command strings (mysql, psql, sqlite3, gunzip) executed via Symfony Process::fromShellCommandline(), so shell metacharacters in the filename are interpreted by /bin/sh. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially exploitable once a crafted archive reaches the restore path.

Technical ContextAI

The affected component is a Laravel package (pkg:composer/wnx_laravel-backup-restore) that companions spatie/laravel-backup by handling database restore from backup ZIP archives. The root cause is CWE-77 (Command Injection): the restore routine enumerates files under db-dumps, resolves the dump to an absolute path, and builds import commands as raw shell strings such as 'mysql ... < {dumpFile}' or 'gunzip -c {dumpFile}'. Because Illuminate\Support\Facades\Process::run(string) delegates to Symfony's Process::fromShellCommandline(), the whole string is handed to the platform shell (/bin/sh on Unix, cmd/PowerShell on Windows) rather than executed as an argv array, so metacharacters ($(), ;, |, backticks) embedded in the attacker-controlled filename are evaluated. Importantly the injection is in the ZIP entry filename metadata, not in the SQL dump content, so it fires before any database import actually reads the dump.

RemediationAI

Primary fix: upgrade to laravel-backup-restore v1.9.4 or later (Vendor-released patch: v1.9.4), e.g. 'composer require wnx/laravel-backup-restore:^1.9.4' then redeploy. The vendor states there is no configuration flag that disables the vulnerable code path, so upgrading is the only complete fix. As interim compensating controls until you can upgrade: restore only backup archives originating from a trusted, integrity-verified source and never from user-supplied or externally-writable storage (trade-off: breaks workflows that ingest external backups); validate or reject ZIP entry filenames under db-dumps that contain shell metacharacters before invoking the restore (trade-off: requires custom code and may reject legitimately odd filenames); and run the restore process under a least-privileged, sandboxed OS account to limit blast radius if injection occurs (trade-off: does not prevent the injection, only contains it). Refer to advisory GHSA-w9mx-xmg4-gc4r for authoritative guidance.