CVE-2020-10808: Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup List...

Security readout for executives and security teams

VestaCP versions through 0.9.8-26 can execute unintended server commands when its backup listing handles a malicious filename. The issue matters most on shared hosting or delegated admin environments where a user can create or rename files and then reach the affected VestaCP backup view. Exposure is likely limited to VestaCP deployments through 0.9.8-26 where users can create or rename files and access the affected backup listing functionality. Prioritize remediation for internet-facing or shared-hosting VestaCP servers. The issue can cross from file-name control into command execution, but the bundle does not prove active exploitation. Mitigation focus: Inventory VestaCP systems and identify versions through 0.9.8-26.; Check VestaCP vendor guidance and security forum for fixed versions or official mitigation.; Restrict VestaCP panel access to trusted administrative networks and accounts..

Prepared

Jun 6, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.