Command Injection Vulnerability in Hestia Control Panel by HestiaCP
CVE-2026-108390

9.9CRITICAL

Key Information:

Vendor

Hestiacp

Status
Hestiacp
Vendor
CVE Published:
14 October 2026

What is CVE-2026-108390?

The Hestia Control Panel suffers from a command injection vulnerability that exists in the update_object_value() function within the main.sh script. Users with low privileges, who have authenticated access, can exploit this issue by injecting an arbitrary PATH value into the user's web.conf file. This can lead to unauthorized code execution with root privileges when the malicious executable is invoked through the system's search functionality. The vulnerability arose through an insufficient escape mechanism for single quotes, which allows attackers to manipulate environment variables and gain elevated control over the system. This critical security flaw was identified between versions 1.9.7 and 1.10.4 and has been remedied in version 1.10.5.

Affected Version(s)

hestiacp >= 1.9.7, < 1.10.5

References

https://github.com/hestiacp/hestiacp/security/advisories/...
x_refsource_CONFIRM
https://github.com/hestiacp/hestiacp/commit/4d86018660f35...
x_refsource_MISC
https://ravindulakmina.pages.dev/advisories/cve-2026-1083...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.