CVE-2026-94835
OS command injection in the database backup function
| CVE | CVE-2026-94835 |
|---|---|
| Status | RESERVED |
| Product | SubMgr |
| Affected | all versions through 3.42 |
| Fixed | commit 658d46c8 (inc_login.php:1302, escapeshellcmd) |
| CWE | CWE-78 |
| CVSS 3.1 | 7.2 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/SUBMGR.md |
Detail
mysqldump_path passes through strip_tags() and stripslashes() on save — neither touches a shell metacharacter. At run time the only guards are strpos($mysqldump_path,'mysqldump') and a space check that double-quotes the value. Keep the literal mysqldump in the payload and use ${IFS} instead of spaces, and both are satisfied; the value reaches shell_exec() when Maintenance > Backup runs.
strip_tags() survives a base64 round-trip, so the reliable primitive is echo <b64>|base64${IFS}-d>file;#.
Chained with CVE-2026-94832 this is pre-authentication RCE on PHP < 8.1.
Remediation
See chains/SUBMGR.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/SUBMGR.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94835.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch