CVE-2019-9859

Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the dangerous command exec. This function can be dangerous if arguments passed to it are not filtered. Every user input in VestaCP that is used as an argument is filtered with the escapeshellarg function. This function comes from the PHP library directly and its description is as follows: "escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument." It means that if you give Username, it will have 'Username' as a replacement. This works well and protects users from exploiting this potentially dangerous exec function. Unfortunately, VestaCP uses this escapeshellarg function incorrectly in several places.

• CWE-78

• https://ssd-disclosure.com/?p=3926Exploit, Third Party Advisory
• https://ssd-disclosure.com/?p=3926Exploit, Third Party Advisory

Published

Mar 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9852LibreOffice has a feature where documents can specify that p…7.8
• CVE-2019-9853LibreOffice documents can contain macros. The execution of t…7.8
• CVE-2019-9854LibreOffice has a feature where documents can specify that p…7.8
• CVE-2019-9855LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9857In the Linux kernel through 5.0.2, the function inotify_upda…
• CVE-2019-9858Remote code execution was discovered in Horde Groupware Webm…8.8
• CVE-2019-9860Due to unencrypted signal communication and predictability o…
• CVE-2019-9861Due to the use of an insecure RFID technology (MIFARE Classi…
• CVE-2019-9862An issue was discovered on ABUS Secvest wireless alarm syste…
• CVE-2019-9863Due to the use of an insecure algorithm for rolling codes in…
• CVE-2019-9864PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Paramet…
• CVE-2019-9865When RPC is enabled in Wind River VxWorks 6.9 prior to 6.9.1…