VestaCP <= 0.9.8-26: authenticated config-parser eval sinks -> root RCE (VESTACP-2026-001)
Full Disclosure reports authenticated root RCE in VestaCP 0.9.8-26 via config-parser eval sinks.
A Full Disclosure advisory, VESTACP-2026-001 (GHSA-m2mc-xwq7-pw72), reports that Vesta Control Panel versions 0.9.8-26 and earlier contain authenticated config-parser evaluation sinks that can lead to root remote code execution. The posted summary says VestaCP stores per-account data in a way that reaches those sinks. The visible report does not assign a CVE or state that exploitation has been observed.
- Authenticated config-parser eval sinks can lead to root remote code execution.
- Affected releases are VestaCP 0.9.8-26 and earlier.
- Tracked as VESTACP-2026-001 and GHSA-m2mc-xwq7-pw72.
- Posted to Full Disclosure on October 15; no exploitation is stated.
From the original article
Posted by Bryan Ramirez via Fulldisclosure on Oct 15 Advisory ID: VESTACP-2026-001 / GHSA-m2mc-xwq7-pw72 Product: Vesta Control Panel (VestaCP) Versions: SUMMARY ------- VestaCP stores per-account...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.