High severity8.8NVD Advisory· Published Mar 22, 2020· Updated Jun 17, 2026
CVE-2020-10808
CVE-2020-10808
Description
Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- VestaCP/Vesta Control Paneldescription
- Range: <=0.9.8-26
- Range: <=0.9.8-26
Patches
Vulnerability mechanics
References
5- github.com/rapid7/metasploit-framework/pull/13094nvdPatchThird Party Advisory
- packetstormsecurity.com/files/157111/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/157219/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- pentest.blog/vesta-control-panel-second-order-remote-code-execution-0day-step-by-step-analysis/nvdExploitThird Party Advisory
- forum.vestacp.com/viewforum.phpnvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.