TYPO3 Backup Plus Command Injection Vulnerability

A command injection vulnerability has been identified in the TYPO3 Backup Plus extension (ns_backup), affecting versions through 13.0.2. The issue arises because the extension does not properly sanitize user input when creating backups, allowing for malicious commands to be executed. Exploitation of this vulnerability requires a valid administrator account.

Impact

Successful exploitation allows for command injection, where an attacker can execute arbitrary commands on the server.

Remediation

Users are advised to update the TYPO3 Backup Plus extension to version 13.0.3, available through the TYPO3 extension manager, Packagist, or by downloading the ZIP file from the TYPO3 extensions repository.