CVE-2026-53932: Stefanzweifel Laravel-Backup-Restore

High severity, CVSS 8.0. EPSS: 1.7% chance of exploitation in the next 30 days.

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.

Affected products

• Stefanzweifel Laravel-Backup-Restore: before 1.9.4 (fixed in 1.9.4)

Published 2026-09-04. Last modified 2026-09-10.