CVE-2026-12195

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

CVSS

No CVSS.

References

Link	Resource
https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422
https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) myVesta está afectado por una vulnerabilidad de ejecución remota de código autenticada. Usuarios con bajos privilegios pueden insertar comandos arbitrarios como parte del parámetro v_ftp_user al eliminar nombres de usuario FTP. Esto podría resultar en la ejecución de comandos como el usuario administrador o la toma de control del usuario administrador en myVesta.

Information

Published : 2026-07-04 12:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-12195

Mitre link : CVE-2026-12195

CVE.ORG link : CVE-2026-12195

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-12195", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12195", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T18:30:24.914869Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a", "affectedData": [{"vendor": "myvesta", "product": "vesta", "versions": [{"status": "affected", "version": "0", "lessThan": "95d7e43bf286d6881ca753dac93cb42d98cc7422", "versionType": "git"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-04T12:16:53.300", "references": [{"url": "https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a"}, {"url": "https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta."}, {"lang": "es", "value": "myVesta est\u00e1 afectado por una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo autenticada. Usuarios con bajos privilegios pueden insertar comandos arbitrarios como parte del par\u00e1metro v_ftp_user al eliminar nombres de usuario FTP. Esto podr\u00eda resultar en la ejecuci\u00f3n de comandos como el usuario administrador o la toma de control del usuario administrador en myVesta."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a"}