# Restored config reaches command execution

Config or plugin settings that name a command or args, writable by lower-privileged users, later executed

_Area: Web injection and code execution. Seen in 3 disclosed reports; latest 2026-10-09. Updated 2026-10-31._

## How it works
An application stores a command or its arguments as a configuration value and later executes it. The assumption that breaks is that config is trusted and only admins can change it. When a restore path, a plugin config setter, or a weak allowlist lets a less-privileged actor write that value, the write becomes code execution at the next trigger. The sink is ordinary config; the flaw is in who can write it and how it is validated.

## Where it shows up
- Restore/import handlers that copy attacker-supplied files into the live config path [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Backup formats that ship key material to the client and derive integrity signatures from it [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Plugin/extension config setters that skip the admin guard applied to core config [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w48f-wwwf-f5fr.md)
- Config options passed straight to subprocess/exec sinks (command, args, file path) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w48f-wwwf-f5fr.md)
- Shell allowlists that check only the first token and block metacharacters [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cv3g-hj65-pcfh.md)
- Allowlisted binaries with their own exec actions (`find -exec`, `tar --to-command`, `awk system()`, `xargs`, `sed e`) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cv3g-hj65-pcfh.md)

## How to review
Trace every write path to any setting that feeds a command sink. The invariant: a value that reaches execution must be writable only by fully trusted principals, and its integrity must not depend on material the writer controls. Check that restore/import cannot overwrite live config, that signatures are keyed by a secret the client never sees, that plugin setters enforce the same admin check as core config, and that allowlists account for the built-in actions of each permitted binary, not just its name.

## Variants seen
- Forged backup re-signed with client-supplied key overwrites protected command setting [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Non-admin plugin config write reaches subprocess with user-controlled binary path [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w48f-wwwf-f5fr.md)
- Allowlisted `find` with `-execdir` runs arbitrary binaries without metacharacters [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-cv3g-hj65-pcfh.md)

## Why fixes fail
E2 shows metacharacter blocking and first-token allowlisting were added after earlier chaining fixes but remained bypassable because the allowlisted binary itself executes programs. Guarding one config branch (core) while leaving the plugin branch open fails the same way [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w48f-wwwf-f5fr.md).

## Impact and severity
Authenticated remote code execution in all three cases, often from a low-privilege account [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-w48f-wwwf-f5fr.md). Severity rises when the write needs no admin role and the trigger is a normal API call.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-cv3g-hj65-pcfh.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-w48f-wwwf-f5fr.md