AIKIDO-2026-720715
wnx/laravel-backup-restore is vulnerable to OS Command Injection
65
Medium Risk
This Affects:
wnx/laravel-backup-restoreTL;DR
The MySQL and PostgreSQL import commands in wnx/laravel-backup-restore concatenate database connection parameters - host, username, password, port, database name, and dump options - into a shell command without escaping them. A connection value containing shell metacharacters reaches a process run through a shell during a database restore and runs arbitrary OS commands. The patch escapes each connection parameter and dump option individually before building the import command.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, and your database connection configuration can be influenced by untrusted input.
Background info
wnx/laravel-backup-restore is vulnerable to OS Command Injection in versions 1.1.3 - 1.9.6.
How to fix this
Upgrade the wnx/laravel-backup-restore library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.