MEDIUM

GHSA-463c-jhp2-4mm7

The Backup Plus extension for TYPO3 (ns_backup) allows command injections

Quick fix

GHSA-463c-jhp2-4mm7 — nitsan/ns-backup: upgrade to the fixed version with the command below.

composer require nitsan/ns-backup:^13.0.1

Details

The ns_backup extension through 13.0.0 for TYPO3 allows command injection when creating a backup. An authenticated backend user with access to the extensions backend module is required to exploit the vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/nitsan/ns-backup

Introduced in: 0Fixed in: 13.0.1

Fixcomposer require nitsan/ns-backup:^13.0.1

References

https://nvd.nist.gov/vuln/detail/CVE-2025-48204[ADVISORY]
https://github.com/nitsan-technologies/ns_backup/commit/67b8102a19e8e516dc4228f5c42f9e4fba5046cb[WEB]
https://github.com/nitsan-technologies/ns_backup[PACKAGE]
https://typo3.org/security/advisory/typo3-ext-sa-2025-007[WEB]