Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.
CVSS Score
9.8
CRITICAL
Published
16 Jul 2026 16:19
Modified
16 Jul 2026 19:16
Source
CIRCL
CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Complexity
Low
Privileges
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Weaknesses (CWE)
CWE-78
CWE-306
Affected Systems
No vendor data available.
External Links
KEV Status
Not in CISA KEV catalog