CVE-2022-25834

HIGH

Percona XtraBackup < 2.2.24 and 3.x-8.0.27-19 - OS Command Injection via Crafted Filename

Title source: llm

Description

In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands.

References (2)

Core 2

Core References

Release Notes

https://docs.percona.com/percona-xtrabackup/8.0/release-notes/8.0/8.0.32-26.0.html#improvements

Vendor Advisory

https://www.percona.com/doc/percona-xtrabackup/2.4/index.html

Scores

CVSS v3 7.8

EPSS 0.0046

EPSS Percentile 36.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-77

Status published

Products (1)

percona/xtrabackup < 2.2.24

Published Jun 07, 2023

Tracked Since Feb 18, 2026