CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-63725

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-53984 Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

PT-2026-68755

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.6.0 Description An unauthenticated database-destruction and arbitrary-data-injection issue exists in the Socket.IO server's database backup event handler. Due to disabled authentication enforcement and a...

Malicious code in dolyame-ui-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be48c86f2b67912c3cfa1849431e5eb3d45510c55bb1fa98ab304dc36d25097b On require of the package, index.js loads vendor.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev hosts...

Malicious code in dolyame-ui-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from...

CVE-2026-71284

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71283

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...

CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71284

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71284

The CVE-2026-71284 issue affects Fledge’s backup-restore upload handler (upload_backup) in python/fledge/services/core/api/backup_restore.py. The handler takes the first extracted tar member’s filename and builds a shell command via string formatting: cmd = "cp {} {}". Since only a prefix/suffix ...

EUVD-2026-53369

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting: cmd = "cp ".formatsource, backuppath; retcode = os.systemcmd. The only pre-check o...

CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

EUVD-2026-53368

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. A crafted tar archive containing member names with ../ path component...

CVE-2026-71283

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...

CVE-2026-71283

CVE-2026-71283 affects Fledge IoT Gateway: the backup_restore upload handler uses tarfile.extractall(temp_path) on an admin-uploaded tar with no member filtering or path validation, allowing path traversal via ../ components. This can extract files outside the temporary directory, enabling arbitr...

CVE-2026-71283 Fledge IoT Gateway Backup Restore Tar Path Traversal

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...

CVE-2026-71283 Fledge IoT Gateway Backup Restore Tar Path Traversal

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...