PT-2026-55693 · Myvesta · Vesta

Eddie Zhang · Publicado 2026-07-04 · Atualizado 2026-07-04 · CVE-2026-12195

Mitre

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v ftp user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-12195

Produtos afetados

Vesta

Referências · 3

• 🔥 https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce · Exploit
• https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-12195 · Nota de Segurança