Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.Referenceshttps://www.exploit-db.com/exploits/37369/http://vestacp.com/roadmap/#historyhttps://www.htbridge.com/advisory/HTB23261
