CVE-2021-28379: Myvestacp Myvesta

High severity, CVSS 8.8. EPSS: 6% chance of exploitation in the next 30 days.

web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.

Affected products

• Myvestacp Myvesta: up to and including 0.9.8-26-39
• Vestacp Vesta Control Panel: up to and including 0.9.8-27

Published 2021-03-15. Last modified 2026-06-17.