CVE-2026-65711 is an OS command injection vulnerability in sysPass through version 3.2.11. Authenticated administrators can exploit this by setting a malicious backup path in the siteBackupPath configuration. The FileBackupService constructs a tar shell command using string concatenation without proper sanitization (e.g., escapeshellarg()), passing the unsanitized input to exec(). This allows injected commands to execute with the privileges of the web server process and persist across backups.

An attacker with administrator privileges can execute arbitrary OS commands as the web server user, potentially leading to full system compromise or persistent malicious code execution. The vulnerability affects the backup functionality, causing injected commands to run on every backup trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and avoid triggering backups with untrusted backup path settings.