CVE-2020-10808

Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

77.50% chance of exploitation in the next 30 days, 100th percentile

Published

2020-03-22

Updated

2024-08-04

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/157111/Vesta-Control-Panel-Authenticated-Remote-Code…
• http://packetstormsecurity.com/files/157219/Vesta-Control-Panel-Authenticated-Remote-Code…
• https://pentest.blog/vesta-control-panel-second-order-remote-code-execution-0day-step-by-…
• CSpanias/vesta-rce-exploit8★ · 2025-06-22

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vestacp_exec.rb

References

• CVE Record
• NVD entry

Related

• CVE-2022-35411
• CVE-2020-10770
• CVE-2020-10809
• CVE-2020-10759
• CVE-2020-10810
• CVE-2020-10757