CVE-2022-36534

Deeper analysis

Syncovery 9 for Linux versions 9.47x and earlier contain multiple remote code execution flaws in the web GUI component post_profilesettings.php. The issues are triggered through the Job_ExecuteBefore and Job_ExecuteAfter parameters, which accept unsanitized input that is later executed by the application.

An attacker with a valid low-privileged account on the Syncovery web interface can supply arbitrary commands in these fields over the network. Successful exploitation grants the ability to run operating-system commands with the privileges of the Syncovery process, resulting in full confidentiality, integrity, and availability impact on the affected Linux host.

Public exploit code has been available since disclosure, and the vulnerability’s EPSS score rose from low values to a peak of 0.8466 in late 2025 before settling at 0.7491, indicating renewed attacker interest well after the original publication. Detailed technical write-ups and proof-of-concept material are published at the mgm-sp.com advisory and Packet Storm entries linked in the CVE references.