The stefanzweifel laravel-backup-restore package is vulnerable to OS command injection, which could allow an authenticated attacker to execute arbitrary code on the underlying system.

This vulnerability is an OS command injection flaw (CWE-78) triggered by processing a maliciously crafted backup archive. The vulnerability requires the attacker to have low-level privileges to initiate the restore process.

Successful exploitation of this vulnerability allows for arbitrary command execution on the server hosting the application. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, or the deployment of persistent threats within the application environment.

Immediate Action: Update the laravel-backup-restore package to version 1.9.4 or later immediately.

Proactive Monitoring: Review web server and application logs for unusual system calls or command execution patterns occurring during backup restoration tasks.

Compensating Controls: Implement strict input validation or file integrity checks for backup archives before they are processed by the restoration module to identify potentially malicious payloads.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk to application integrity and server security. IT teams should prioritize updating the laravel-backup-restore dependency to version 1.9.4 to neutralize the command injection vector. Failure to patch may allow attackers with low-level access to gain full control over the host system.