CVE-2026-53932

HighCVSS 8.0/10Last modified Sep 10, 2026

Description

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
stefanzweifel	laravel-backup-restore	< 1.9.4

References

Timeline

Published: Sep 4, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-539336.9Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. Wh CVE-2026-539356.9Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with CVE-2026-539376.2MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadB CVE-2026-539388.2OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decrypt CVE-2026-539399.1OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose CVE-2026-53947.0An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index meta CVE-2026-539408.8Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_en CVE-2026-539416.9Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF CVE-2026-539429.9Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request CVE-2026-539439.6Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content CVE-2026-539445.8Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filt CVE-2026-539454.0Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed