The wnx/laravel-backup-restore package versions prior to 1.9.4 contain an OS command injection vulnerability triggered during database restore. The restore process extracts a ZIP archive and enumerates files under the db-dumps directory. Filenames are converted to absolute paths and interpolated directly into shell command strings for database import commands (e.g., mysql, psql, sqlite3) without shell escaping. Because the underlying process execution uses Symfony's Process::fromShellCommandline(), shell metacharacters in filenames are interpreted by the system shell, enabling command injection. This vulnerability allows arbitrary command execution as the PHP/Laravel application user if a malicious backup archive is restored.

An attacker able to cause a malicious backup archive to be restored can execute arbitrary shell commands on the host system with the privileges of the PHP/Laravel application user. This can lead to full application compromise, disclosure of database credentials, tampering with restored data, and potential lateral movement within the environment depending on deployment permissions.

A patch fixing this vulnerability is available in version 1.9.4 of wnx/laravel-backup-restore. Upgrading to version 1.9.4 or later is the only complete fix. There are no configuration options or workarounds to disable the vulnerable code path, so upgrading is strongly recommended.