CVE-2026-12195: myVesta Authenticated RCE Vulnerability

CVE-2026-12195 Overview

CVE-2026-12195 is an authenticated remote code execution vulnerability in myVesta, a fork of the Vesta Control Panel used to manage web hosting environments. The flaw exists in the FTP account deletion workflow. A low-privileged authenticated user can inject arbitrary operating system commands through the v_ftp_user parameter when removing an FTP account. The injected commands run in the context of the admin user, enabling full takeover of the myVesta administrative account. The weakness is classified as OS Command Injection [CWE-78].

Critical Impact
Any authenticated low-privileged myVesta user can execute arbitrary commands as the admin user, resulting in complete compromise of the hosting control panel and all managed sites.

Affected Products

myVesta Control Panel (versions prior to commit 95d7e43bf286d6881ca753dac93cb42d98cc7422)
web/edit/web/index.php FTP deletion handler
Deployments exposing the myVesta admin interface with multi-tenant user accounts

Discovery Timeline

2026-07-04 - CVE-2026-12195 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-12195

Vulnerability Analysis

The vulnerability resides in the FTP account deletion routine within web/edit/web/index.php. The application concatenates user-controlled input directly into a shell command invoked via PHP's exec() function. The v_ftp_user parameter is submitted as part of the FTP account deletion request. Because the value is not shell-escaped before being passed to the v-delete-web-domain-ftp command, attackers can break out of the intended argument and append additional shell tokens. The backend commands executed by the myVesta CLI run with elevated privileges through the VESTA_CMD wrapper, which grants the attacker admin-level command execution on the underlying host.

Root Cause

The root cause is missing input sanitization on the v_ftp_user value before it is interpolated into a shell command string. The vulnerable code path uses direct string concatenation instead of escapeshellarg(), allowing metacharacters such as ;, |, &&, and backticks to be interpreted by the shell. This is a textbook OS Command Injection pattern [CWE-78].

Attack Vector

An attacker with a valid low-privileged myVesta account authenticates to the web interface and issues a request to delete an FTP account. The attacker supplies a crafted v_ftp_user value containing shell metacharacters and injected commands. When the backend invokes v-delete-web-domain-ftp, the shell interprets the injected payload and executes attacker-supplied commands as the admin user. The attacker can then modify admin credentials, exfiltrate hosted site data, or pivot into the underlying operating system.

php

// Vulnerable code (before) and fix (after) in web/edit/web/index.php
// Delete FTP account
if ($v_ftp_user_data['delete'] == 1) {
    $v_ftp_username = $user . '_' . $v_ftp_user_data['v_ftp_user'];
-   exec (VESTA_CMD."v-delete-web-domain-ftp ".$v_username." ".$v_domain." ".$v_ftp_username, $output, $return_var);
+   exec (VESTA_CMD."v-delete-web-domain-ftp ".$v_username." ".$v_domain." ".escapeshellarg($v_ftp_username), $output, $return_var);
    check_return_code($return_var,$output);
    unset($output);
}
// Source: https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422

The patch wraps $v_ftp_username in escapeshellarg(), which quotes and escapes the argument so that shell metacharacters are treated as literal characters.

Detection Methods for CVE-2026-12195

Indicators of Compromise

Unexpected child processes spawned by the myVesta PHP worker or the v-delete-web-domain-ftp script, such as /bin/sh -c, bash, curl, wget, or nc.
HTTP POST requests to the myVesta web edit endpoints containing shell metacharacters (;, |, `, $(, &&) inside the v_ftp_user parameter.
Modifications to /usr/local/vesta/conf/ or admin credential files immediately following an FTP deletion request.
Newly created cron jobs, SSH keys, or user accounts on the host shortly after web-panel activity from a low-privileged account.

Detection Strategies

Inspect webserver access logs for FTP deletion requests where v_ftp_user contains non-alphanumeric characters beyond underscore.
Alert on exec, shell_exec, or /bin/sh invocations by the myVesta PHP process that do not match the expected v-* command whitelist.
Correlate authentication events for low-privileged panel users with subsequent process execution as the admin or root user.

Monitoring Recommendations

Enable verbose audit logging on the myVesta host using auditd to record process creation with parent process context.
Forward myVesta web logs and Linux audit logs to a centralized log platform for correlation and long-term retention.
Baseline the set of commands normally executed by the panel and alert on deviations, especially outbound network utilities.

How to Mitigate CVE-2026-12195

Immediate Actions Required

Update myVesta to a build that includes commit 95d7e43bf286d6881ca753dac93cb42d98cc7422 or later.
Restrict access to the myVesta administrative interface to trusted management networks using firewall or VPN controls.
Audit all existing panel user accounts and remove or rotate credentials for accounts that are not strictly required.
Review recent FTP deletion activity and host process history for signs of prior exploitation.

Patch Information

The upstream fix is available in the myVesta repository at commit 95d7e43bf286d6881ca753dac93cb42d98cc7422. The patch applies escapeshellarg() to the $v_ftp_username value in web/edit/web/index.php before passing it to exec(). Additional technical background is available in the Project Black analysis.

Workarounds

If immediate patching is not possible, manually apply the escapeshellarg() change to web/edit/web/index.php on affected installations.
Temporarily disable the FTP account deletion feature for non-admin users by adjusting panel role permissions.
Place a web application firewall rule in front of myVesta to block requests where v_ftp_user contains shell metacharacters.

bash

# Example WAF-style filter using ModSecurity to block command injection in v_ftp_user
SecRule ARGS:v_ftp_user "@rx [;|&`$()<>\\\"']" \
    "id:1026195,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-12195: Possible command injection in myVesta v_ftp_user parameter'"