CVE-2026-53932

CVE-2026-53932 is a high-severity command injection vulnerability in wnx/laravel-backup-restore (composer), affecting versions <= 1.9.3. It is fixed in 1.9.4.

Check whether CVE-2026-53932 affects your applications

Kodem tells you whether this CVE is present, reachable, and actually executing in your application, so you know if it matters.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence. Only the CVEs that actually run in production.

Summary

laravel-backup-restore has an OS Command Injection during database restore

Full technical description

A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings.

The dump filename is not shell-escaped before it is interpolated into commands such as:

  • mysql ... < {dumpFile}
  • gunzip -c {dumpFile} / gunzip < {dumpFile}
  • psql ... < {dumpFile}
  • sqlite3 ... < {dumpFile}

Because Illuminate\Support\Facades\Process::run(string) uses Symfony Process::fromShellCommandline(), shell metacharacters in the dump filename are interpreted by /bin/sh on Unix-like systems or by the platform shell on Windows.

Workarounds

There is no configuration option that disables the vulnerable code path. Upgrading to the patched release is the only complete fix.

Impact

If an attacker can cause an operator or automation to restore a malicious backup archive, the attacker can execute arbitrary shell commands as the PHP/Laravel application user on the system performing the restore. This can lead to application compromise, database credential disclosure, tampering with restored data, and further lateral movement depending on deployment permissions.

This is not about malicious SQL inside the dump. The command injection is carried in the ZIP entry filename under db-dumps, before the dump content is imported.

Untrusted input is inserted into a command that is later executed by the application, allowing the attacker to alter the intent of that command. Typical impact: arbitrary command execution in the application's environment.

CVE-2026-53932 has a CVSS score of 8.0 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.9.4); upgrading removes the vulnerable code path.

Affected versions

wnx/laravel-backup-restore (<= 1.9.3)

Security releases

wnx/laravel-backup-restore → 1.9.4 (composer)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

The vulnerability has been fixed in v1.9.4 of the package.

Frequently Asked Questions

  1. What is CVE-2026-53932? CVE-2026-53932 is a high-severity command injection vulnerability in wnx/laravel-backup-restore (composer), affecting versions <= 1.9.3. It is fixed in 1.9.4. Untrusted input is inserted into a command that is later executed by the application, allowing the attacker to alter the intent of that command.
  2. How severe is CVE-2026-53932? CVE-2026-53932 has a CVSS score of 8.0 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
  3. Which versions of wnx/laravel-backup-restore are affected by CVE-2026-53932? wnx/laravel-backup-restore (composer) versions <= 1.9.3 is affected.
  4. Is there a fix for CVE-2026-53932? Yes. CVE-2026-53932 is fixed in 1.9.4. Upgrade to this version or later.
  5. Is CVE-2026-53932 exploitable, and should I be worried? Whether CVE-2026-53932 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  6. What actually determines whether CVE-2026-53932 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  7. How do I fix CVE-2026-53932? Upgrade wnx/laravel-backup-restore to 1.9.4 or later.

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo