ByteOS Network

CVE Vulnerability Details :

CVE-2026-12195

PUBLISHED

More Info Official Page

Assigner-PRJBLK

Assigner Org ID-ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a

Published At-04 Jul, 2026 | 11:33

Updated At-04 Jul, 2026 | 11:33

▼CVE Numbering Authority (CNA)

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

Affected Products

Vendor

myvesta

Product

vesta

Default Status

unaffected

Versions

Affected

From 0 before 95d7e43bf286d6881ca753dac93cb42d98cc7422 (git)

Problem Types

Type	CWE ID	Description
CWE	CWE-78	CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Type: CWE

CWE ID: CWE-78

Description: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Metrics

Version	Base score	Base severity	Vector
4.0	8.5	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Version: 4.0

Base score: 8.5

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Impacts

CAPEC ID	Description
CAPEC-88	CAPEC-88 OS Command Injection

CAPEC ID: CAPEC-88

Description: CAPEC-88 OS Command Injection

References

Hyperlink	Resource
https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422	patch
https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce	exploit

Hyperlink: https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422

Resource:

patch

Hyperlink: https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce

Resource:

exploit

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References