RCE in Myvesta Vesta

CVE-2026-12195

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.004 (35.4th percentile) — read the EPSS interpretation.