sysdopllc/vestacp-config-eval-rceSecurity advisory: VestaCP <= 0.9.8-26 authenticated config-parser eval sinks -> root RCE (ancestor of HestiaCP GHSA-w3mx/cr7q, never disclosed for VestaCP)
eval sinks → root RCE (VESTACP-2026-001)Security advisory for the original Vesta Control Panel (VestaCP) ≤ 0.9.8-26
(github.com/serghey-rodin/vesta, vestacp.com — unmaintained since September
2019): the shared config parser in func/main.sh evaluates user-controllable
KEY='value' lines with eval inside v-* scripts that run as root — an
authenticated panel user can escalate to full root on the hosting node.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)This is the same sink class fixed in the maintained fork HestiaCP in July
2026 — CVE-2026-84981,
CVE-2026-84984,
CVE-2026-84979 —
never disclosed or fixed for the original VestaCP, its ancestor. It is also
distinct from VestaCP's earlier CVEs (CVE-2019-9859 PHP layer,
CVE-2021-30462/30463 LPE chain, CVE-2022-3967 sed injection); see the
advisory's Prior art section. Published for the install base still running
VestaCP in production (widely shipped in VPS templates).
advisory/VESTACP-2026-001.md — full
advisory: affected sinks, exploitation path, impact, prior art, scope,
mitigation, timeline.poc/poc-eval-sink.sh — self-contained proof of
concept: simulates the vulnerable eval parse on a crafted conf line and
shows the hardened parser neutralizing it. Runs in a mktemp sandbox; does
not require a VestaCP install.mitigation/non-eval-parser.sh — drop-in
parse_object_kv_list + porting recipe for every eval site.bash poc/poc-eval-sink.sh
Expected: the vulnerable parse creates a marker file (injection executed); the hardened parse leaves it inert (value kept literal).
Bryan Ramirez — SYSDOP LLC · [email protected]
Discovered during a defensive security audit of production hosting infrastructure, August 2026. Disclosed October 2026.