CVE-2026-53932: laravel-backup-restore has an OS Command Injection during database restore

A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings.

The dump filename is not shell-escaped before it is interpolated into commands such as:

• mysql ... < {dumpFile}
• gunzip -c {dumpFile} / gunzip < {dumpFile}
• psql ... < {dumpFile}
• sqlite3 ... < {dumpFile}

Because Illuminate\Support\Facades\Process::run(string) uses Symfony Process::fromShellCommandline(), shell metacharacters in the dump filename are interpreted by /bin/sh on Unix-like systems or by the platform shell on Windows.