A high severity OS command injection vulnerability in the Adaltas backmeup package allows authenticated users to execute arbitrary commands on the underlying host system.

This vulnerability involves CWE-78: OS Command Injection. The software fails to sanitize input options such as name, source, destination, and filter before including them in shell command strings, allowing an authenticated user with low privileges to inject and execute arbitrary system commands.

The vulnerability carries a CVSS score of 8.8, reflecting the high risk posed by successful exploitation. An attacker successfully leveraging this flaw could gain full control over the host system, leading to unauthorized data exfiltration, modification of critical system files, or complete service disruption.

Immediate Action: Currently, there is no vendor-supplied patch available. Users should evaluate the necessity of the backmeup package and consider removing or disabling it until a secure version is released.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or unexpected shell commands originating from the service user account.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to inspect and block malicious payloads containing shell metacharacters in request parameters.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of command injection, this vulnerability poses a severe threat to system integrity. Organizations using the backmeup package are advised to restrict access to the application and monitor for signs of unauthorized activity while awaiting an official security update.