Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2019-9859

Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the dangerous command exec. This function can be dangerous if arguments passed to it are not filtered. Every user input in VestaCP that is used as an argument is filtered with the escapeshellarg function. This function comes from the PHP library directly and its description is as follows: "escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument." It means that if you give Username, it will have 'Username' as a replacement. This works well and protects users from exploiting this potentially dangerous exec function. Unfortunately, VestaCP uses this escapeshellarg function incorrectly in several places.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2019-9859
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 05:33 UTC · Revision 1

Source evidence

CVE-2019-9859

core-osv · Original source

Published 10 Mar 2020, 13:15 UTC

Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the dangerous command exec. This function can be dangerous if arguments passed to it are not filtered. Every user input in VestaCP that is used as an argument is filtered with the escapeshellarg function. This function comes from the PHP library directly and its description is as follows: "escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument." It means that if you give Username, it will have 'Username' as a replacement. This works well and protects users from exploiting this potentially dangerous exec function. Unfortunately, VestaCP uses this escapeshellarg function incorrectly in several places.

osv:CVE-2019-9859
Complete source record
{
  "id": "0d91d1bc13290d11d3e1f25b8df775e21f19d966d08f68670b8bc5b3cff403ae",
  "url": "https://osv.dev/vulnerability/CVE-2019-9859",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2019-9859",
    "summary": "Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the dangerous command exec. This function can be dangerous if arguments passed to it are not filtered. Every user input in VestaCP that is used as an argument is filtered with the escapeshellarg function. This function comes from the PHP library directly and its description is as follows: \"escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument.\" It means that if you give Username, it will have 'Username' as a replacement. This works well and protects users from exploiting this potentially dangerous exec function. Unfortunately, VestaCP uses this escapeshellarg function incorrectly in several places.",
    "evidence": "osv:CVE-2019-9859",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2019-9859",
      "aliases": [
        "CVE-2019-9859"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/outroll/vesta",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "cde42691701667502369f76e197c30005431f959"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:vestacp:vesta_control_panel:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0.9.7-0"
                      },
                      {
                        "last_affected": "0.9.8-23"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.9.8-23",
            "0.9.8-20",
            "0.9.8-19",
            "0.9.8-18",
            "0.9.8-17",
            "0.9.8-16",
            "0.9.8-15",
            "0.9.8-13",
            "0.9.8-12",
            "0.9.8-11",
            "0.9.8-10"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9859.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:30.365937608Z",
      "provider": "osv",
      "references": [
        "https://ssd-disclosure.com/?p=3926"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2019-9859",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 432557,
  "published_at": "2020-03-10T13:15:12.657+00:00"
}