Which versions of myVesta are affected by CVE-2026-12195?

myVesta hosting control panel contains a privilege escalation vulnerability (CVE-2026-12195, CVSS 8.5) with publicly available exploit code exists.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12195?

Yes, a public proof-of-concept exploit is available for CVE-2026-12195. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-12195?

24 hours: Inventory all myVesta instances and determine versions; assess for breach indicators. 7 days: Apply vendor-released patch (obtain exact version from vendor advisory) to all systems, prioritizing production. 30 days: Complete patching across all deployments, audit logs for unauthorized FTP account deletions and administrative commands, validate access control effectiveness.

myVesta CVE-2026-12195

Q: What is the CVSS score of CVE-2026-12195?

CVE-2026-12195 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-41665 HIGH

OS Command Injection (CWE-78)

2026-07-04 PRJBLK

GHSA-233w-5rfj-8hmj

RCE Command Injection Vesta Myvesta

8.5

CVSS 4.0 · Vendor: PRJBLK

Severity by source

Vendor (PRJBLK) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable panel with a low-privileged account (PR:L, AC:L) injecting commands run as admin, a privilege boundary crossing (S:C) yielding full host compromise (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (PRJBLK).

CVSS VectorVendor: PRJBLK

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 12:21 vuln.today

DescriptionCVE.org

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

AnalysisAI

Authenticated OS command injection in the myVesta hosting control panel lets a low-privileged user inject arbitrary shell commands through the v_ftp_user parameter during FTP-account deletion, escalating to full command execution as the admin user and takeover of the panel. Publicly available exploit code exists (documented by ProjectBlack/PRJBLK) and a vendor fix commit has been published, though no CISA KEV listing or EPSS data is provided. Because a scope change moves the attacker from a low-privilege panel account to admin-level command execution, this is a high-impact privilege-escalation-to-RCE path.

Technical ContextAI

myVesta is an open-source web hosting control panel (a maintained fork of the VestaCP project, CPE cpe:2.3:a:myvesta:vesta) that manages web, DNS, mail and FTP services through a PHP front end backed by shell scripts run under elevated privileges. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the FTP-username value supplied in the v_ftp_user parameter is passed unsanitized into a shell command executed during the delete-FTP-user workflow, so shell metacharacters embedded in the username become part of the command line. Panel actions are typically dispatched to backend v-* helper scripts running as a privileged/admin account, which is why injected commands run with admin rather than the requesting user's privileges.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor fix from commit 95d7e43bf286d6881ca753dac93cb42d98cc7422 (https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422) by updating myVesta to a build that includes it, since no discrete patched version number is published in the available data. Until you can deploy the fixed code, reduce exposure by restricting who holds low-privileged panel accounts and treating account creation as sensitive, and limit network reachability of the panel by firewalling the control-panel port (default 8083) to trusted admin IPs or a VPN - accepting that this blocks legitimate remote user self-service. As a stopgop you can also disable or tightly control the FTP-user management feature for non-admin users so the delete-FTP-user code path cannot be reached by untrusted accounts, with the trade-off that tenants lose self-service FTP management.