CVE-2026-53932

wnx/laravel-backup-restore (vulnerable prior to 1.9.4 ) is subject to OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, and interpolates the dump filename into shell command strings (e.g., mysql ...

CVE-2026-53932 wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the restore process. An attacker can execute arbitrary shell commands as the application user by crafting a malicious backup archive containing specially named files that are processed during restoration. Remediati...