laravel-backup-restore has an OS Command Injection during database restore

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.0 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

• CVE-2026-53932: 1.68% estimated exploitation activity in the next 30 days; percentile 76.94 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings. The dump filename is not shell-escaped before it is interpolated into commands such as: - mysql ... < {dumpFile} - gunzip -c {dumpFile} / gunzip < {dumpFile} - psql ... < {dumpFile} - sqlite3 ... < {dumpFile} Because Illuminate\Support\Facades\Process::run(string) uses Symfony Process::fromShellCommandline(), shell metacharacters in the dump filename are interpreted by /bin/sh on Unix-like systems or by the platform shell on Windows. Impact If an attacker can cause an operator or automation to restore a malicious backup archive, the attacker can execute arbitrary shell commands as the PHP/Laravel application user on the system performing the restore. This can lead to application…

Published by the source

9 Jul 2026, 20:52 UTC

Last modified by the source

9 Jul 2026, 20:52 UTC

Source last checked

26 Oct 2026, 14:50 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-w9mx-xmg4-gc4r

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-53932

Advisory: laravel-backup-restore has an OS Command Injection during database restore
IDs: CVE-2026-53932, GHSA-w9mx-xmg4-gc4r
Record: https://patchnext.com/advisories/cve-2026-53932 (revision 1, source checked 26 Oct 2026, 14:50 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.0)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: wnx/laravel-backup-restore 1.9.4. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist wnx/laravel-backup-restore: affected <= 1.9.3; fixed in 1.9.4

## Suggested inspection (read-only)
- Packagist wnx/laravel-backup-restore: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on wnx/laravel-backup-restore.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-w9mx-xmg4-gc4r (GitHub-reviewed advisory GHSA-w9mx-xmg4-gc4r lists affected ranges: Packagist wnx/laravel-backup-restore >=0 <=1.9.3)

Commands are suggestions: review each one before running it.