In sysPass 3.0.0, the FileBackupService::doBackupFiles() method constructs a tar command by concatenating the backup directory path directly into the shell command string without using escapeshellarg() or validating the path. This path is configurable via the admin API or UI and stored in the database. An attacker with admin access can inject shell metacharacters into this path, causing arbitrary OS command execution under the web server user context. Given sysPass's role as a password manager, this can lead to disclosure of the master password, decryption keys, and all stored credentials, as well as enabling lateral movement and persistent compromise.

Successful exploitation allows an attacker with admin privileges to execute arbitrary OS commands as the web server user (typically www-data or apache). This can lead to full disclosure of the password vault, including the master password and encryption keys, enabling decryption of all stored credentials. The attacker can also pivot to internal systems using these credentials and install persistent backdoors on the host running sysPass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for suspicious activity. Avoid using untrusted input in backup path configuration. Consider manual review or temporary disabling of backup operations if feasible.