rootpwn

critical · CVSS v3 8.8 · CVSS v4 8.7

CVE-2026-62943

btrbk, a Btrfs snapshot and backup tool, had a flaw in its ssh_filter_btrbk.sh script that allowed attackers to bypass the command allowlist

Overview

btrbk, a Btrfs snapshot and backup tool, had a flaw in its ssh_filter_btrbk.sh script that allowed attackers to bypass the command allowlist via a forced command in authorized_keys, enabling arbitrary command execution on the backup target. The vulnerability exists in versions 0.29.0 through 0.32.6 and is fixed in 0.32.7. It can be exploited by users who have SSH access to the backup target but are restricted to btrbk commands.

Description

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_filter_btrbk.sh constructs allow_stream_match with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorized_keys forced command can append a trailing pipe command after a valid btrbk command prefix, bypassing the allowlist and executing arbitrary commands with the privileges of the backup-target SSH account. Deployments that do not use ssh_filter_btrbk.sh in authorized_keys are not affected. This issue is fixed in version 0.32.7.

Impact

Confidentiality: potential exposure of backup data. Integrity: attacker can modify or inject malicious files into backups. Availability: attacker could disrupt backup operations. Impacted parties: administrators of systems using btrbk with SSH forced commands, especially those with restricted authorized_keys.

Remediation

Upgrade to btrbk 0.32.7 or later. If upgrade is not possible, remove or disable ssh_filter_btrbk.sh from authorized_keys, or enforce stricter command restrictions. Ensure SSH forced commands are limited to the exact btrbk command syntax and include end-of-string anchors. Monitor SSH logs for unexpected command patterns.

Risk context

Critical severity with a CVSS v3 score of 8.8 indicates a high risk to affected deployments. No EPSS data is available, so immediate attention is recommended.

Affected products

  • btrbk 0.29.0-0.32.6

Scores

Severity
critical
CVSS v2
10
CVSS v3
8.8
CVSS v4
8.7
EPSS
—

btrbk ssh command-injection snapshot remote-backup critical authorized_keys

← All CVEs

Related CVEs

critical

CVE-2026-93922

SiYuan up to version 3.8.4 fails to properly sanitize notebook names when rendering them within the Daily Note picker dialog. This vulnerability leads to stored cross-site scripting inside the application's Electron renderer context. Because the renderer possesses Node.js integration, the resulting JavaScript execution escalates into full operating system command execution on the host machine.

View analysis

critical

CVE-2026-93923

SiYuan up to version 3.8.4 contains a stored cross-site scripting vulnerability in its outline and bookmark dock HTML rendering. Attackers can inject malicious style values through crafted notebooks or administrative endpoints. This vulnerability matters because the application runs within an Electron renderer with full system access.

View analysis

critical

CVE-2026-63349

AnyIO versions prior to 4.14.2 incorrectly handle the extra_groups argument in process launching functions on POSIX systems. When callers attempt to clear inherited supplementary groups, the argument is misplaced, causing child processes to retain unintended parent privileges. This breaks privilege-dropping security boundaries in applications relying on these subprocess helpers.

View analysis

critical

CVE-2026-77240

WACRM, a self-hosted WhatsApp CRM template, has a critical flaw in its Supabase migrations that lets authenticated users alter their account role and tenant association, enabling privilege escalation and cross-tenant data access. The vulnerability also allows non-members to read another tenant’s knowledge-base chunks via SECURITY DEFINER functions. It was fixed in commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f.

View analysis