Advisories for Composer/Nitsan/Ns-Backup package

The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. This allows an unauthenticated remote user to download created backups and configuration files.

The ns_backup extension through 13.0.0 for TYPO3 allows XSS.

The ns_backup extension through 13.0.0 for TYPO3 allows command injection when creating a backup. An authenticated backend user with access to the extensions backend module is required to exploit the vulnerability.