Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

wnx/laravel-backup-restore

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.0PackagistPublished

    laravel-backup-restore has an OS Command Injection during database restore

    CVE-2026-53932 · GHSA-w9mx-xmg4-gc4r

    Affected
    • Packagist wnx/laravel-backup-restore <= 1.9.3
    Fixed in
    1.9.4· Vendor fix available
    Issue
    A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings. The dump filename is not shell-escaped before it is interpolated into commands such as: - mysql ... < {dumpFile} - gunzip -c {dumpFile} / gunzip < {dumpFile} - psql ... < {dumpFile} - sqlite3 ... < {dumpFile} Because Illuminate\Support\Facades\Process::run(string) uses Symfony Process::fromShellCommandline(), shell metacharacters in the dump filename are interpreted by /bin/sh on Unix-like systems or by the platform shell on Windows. Impact If an attacker can cause an operator or automation to restore a malicious backup archive, the attacker can execute arbitrary shell commands as the PHP/Laravel application user on the system performing the restore. This can lead to application…

    Recommended action: Upgrade to 1.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →