In sysPass 3.0.0, the FileBackupService::doBackupFiles() method constructs a tar command by directly concatenating the backup directory path from configuration into the shell command string without using escapeshellarg() or validating the input. Since this path is writable via the admin settings API and UI, an attacker with administrative privileges can inject shell metacharacters to execute arbitrary commands as the web server user. This vulnerability (CWE-78) allows code execution that can expose sensitive password vault data, decrypt stored credentials, and enable lateral movement or persistent backdoors on the host.

An attacker with administrative access to sysPass can exploit this vulnerability to execute arbitrary OS commands as the web server user (commonly www-data or apache). This leads to full compromise of the password manager, including reading the master password and encryption keys from memory or configuration, decrypting all stored credentials, exporting the entire password vault, and potentially pivoting to other internal systems or installing persistent malware on the host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and avoid using untrusted input in backup path configuration. Monitor for updates from the vendor regarding an official fix or workaround.