laravel-backup-restore has an OS Command Injection during database restore
A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, converts the dump path to an absolute path, and passes that path into database import commands that are built as shell command strings. The dump filename is not shell-escaped before it is interpolated into commands such as: mysql … < {dumpFile} gunzip -c {dumpFile} / gunzip < …