CVE-2026-12195 describes an OS command injection vulnerability in myVesta vesta. Authenticated users with low privileges can exploit improper neutralization of special elements in the v_ftp_user parameter when deleting FTP usernames. This allows execution of arbitrary commands with administrative privileges, potentially leading to full admin account takeover. The vulnerability has a CVSS 4.0 score of 8.5, indicating high impact and ease of exploitation without user interaction. No vendor advisory or patch information is available, and affected versions are unspecified.

Successful exploitation enables low privileged authenticated users to execute arbitrary OS commands as the admin user, resulting in remote code execution and potential full administrative takeover of the myVesta system. This compromises system integrity and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to FTP user deletion. Avoid using the vulnerable functionality if possible.