CVE-2022-36303: Vestacp Vesta Control Panel

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php.

Affected products

• Vestacp Vesta Control Panel: version 1.0.0-5 only

Published 2022-07-19. Last modified 2026-06-17.