VestaCP root RCE (VESTACP-2026-001)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-15 07:43 UTC
Importiert: 2026-10-20 20:24 UTC
Quelle-ID: full_disc
uid_hash: 75d327adbb1a4fc83120eecabdadc81af4fdab5de03526798305f33408c55aee

Full Disclosure

Posted by Bryan Ramirez via Fulldisclosure on Oct 15 Advisory ID: VESTACP-2026-001 / GHSA-m2mc-xwq7-pw72

Product: Vesta Control Panel (VestaCP)

Versions: <= 0.9.8-26 (unmaintained since 2019-09; no upstream fix exists)

Severity: Critical - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9

CWE: CWE-78 (OS Command Injection), CWE-95 (Eval Injection)

Reporter: Bryan Ramirez - SYSDOP LLC <security () sysdop com>

SUMMARY

VestaCP stores per-account...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss