CVE-2026-53932

laravel-backup-restore, the package used to restore database backups created with spatie/laravel-backup, fails to safely handle crafted backup archives, allowing OS command injection (CWE-78/CWE-77) when a database restore is performed. An attacker triggers the flaw by supplying or tampering with a backup archive that an application then restores, for example via an admin-initiated or automated restore of an uploaded or externally stored file. Successful exploitation yields arbitrary command execution on the host running the restore, with high impact on confidentiality, integrity, and availability under the restore process's privileges (CVSS 8.0, requiring limited privileges and user interaction to initiate the restore). Any Laravel application running a version of laravel-backup-restore prior to 1.9.4 that restores archives not fully under its own control is affected; applications that only restore self-generated, trusted backups have lower practical exposure. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.9% chance of exploitation within 30 days.

What to do: Upgrade laravel-backup-restore to version 1.9.4 or later. Until upgraded, only restore backup archives from trusted, self-generated sources and restrict who can upload or trigger restores. Watch for the publication of a public PoC, as command-injection flaws of this type are often weaponized once details circulate.