OS Command Injection Vulnerability in Laravel Backup Restore by Stefanzweifel
CVE-2026-53932

8HIGH

Key Information:

Vendor

Stefanzweifel

Status
Laravel-backup-restore
Vendor
CVE Published:
4 September 2026

What is CVE-2026-53932?

A vulnerability in laravel-backup-restore prior to version 1.9.4 allows an attacker to craft a malicious backup archive that, when restored, can execute arbitrary operating system commands. This vulnerability poses significant risks to database integrity and system security. Users are advised to upgrade to version 1.9.4 or later to mitigate this issue. More information can be found in the related advisories and updates.

Affected Version(s)

laravel-backup-restore < 1.9.4

References

https://github.com/stefanzweifel/laravel-backup-restore/s...
x_refsource_CONFIRM
https://github.com/stefanzweifel/laravel-backup-restore/p...
x_refsource_MISC
https://github.com/stefanzweifel/laravel-backup-restore/c...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.