CVE-2018-10686: XSS
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-10686?
CVE-2018-10686 is a vulnerability discovered in Vesta Control Panel 0.9.8-20 that allows for reflected cross-site scripting (XSS) attacks and potential remote PHP code execution.
How severe is CVE-2018-10686?
CVE-2018-10686 has a severity rating of medium, with a CVSS score of 6.1.
What software versions are affected by CVE-2018-10686?
Vesta Control Panel version 0.9.8-20 is affected by CVE-2018-10686.
How can CVE-2018-10686 be exploited?
CVE-2018-10686 can be exploited through reflected XSS via the $_REQUEST['path'] parameter to the view/file/index.php URI, which can lead to remote PHP code execution.
Are there any references for CVE-2018-10686?
Yes, you can find more information about CVE-2018-10686 on the following sources: [Github Issue](https://github.com/serghey-rodin/vesta/issues/1558), [Medium Article](https://medium.com/@ndrbasi/cve-2018-10686-vestacp-rce-d96d95c2bde2).