Hestia Panel Users Urged to Update to 1.10.5 After Critical Root Escalation Flaw

Hestia Control Panel versions 1.9.7 through 1.10.4 are affected by a critical vulnerability that permits authenticated users to escalate privileges to root. Version 1.10.5 has been released to address this issue, patching the path injection flaw identified as CVE-2026-108390.

What happened

The flaw exists in the `update_object_value()` function within `func/main.sh` of Hestia Control Panel. According to the NVD record, this function fails to escape single quotes when writing custom document-root values to a user's `web.conf` file. This oversight allows a low-privileged authenticated user with a web domain to inject an additional `PATH` field into the configuration. The vulnerability was introduced in version 1.9.7 when the original raw `eval` sink, addressed by CVE-2026-84984, was replaced by `parse_object_kv_list_non_eval()`. This residual weakness remains in versions up to 1.10.4.

When the user invokes the ordinary Search feature, the root-privileged `v-search-user-object` script loads the forged field. The `parse_object_kv_list_non_eval()` function permits reserved shell-variable names and globally replaces the `PATH` variable before invoking `column` without an absolute path. By placing a malicious `column` executable in the injected search path, the user can execute arbitrary code as root. The CVSS score for this vulnerability is 9.9, rated as critical by the NVD.

Why it matters

This vulnerability represents a significant risk for organisations using Hestia Control Panel for web hosting management. An attacker with a basic user account can gain full root access to the server, compromising all hosted websites and data. The ease of exploitation, requiring only the use of the search feature, increases the likelihood of abuse. The flaw stems from a previous mitigation attempt that inadvertently introduced a new vector for privilege escalation.

What happens next

• Identify all servers running Hestia Control Panel versions 1.9.7 through 1.10.4.
• Verify if any low-privileged users have access to the search feature.
• Plan the immediate upgrade to version 1.10.5 to close the vulnerability.
• Review server logs for signs of unauthorized root access or unusual `column` executions.

Patch priority

Organisations should prioritise systems exposed to the internet or accessible by multiple users. Teams usually begin by isolating affected control panels from untrusted networks to limit exposure. It is advisable to test the update in a non-production environment to ensure compatibility with existing configurations. Back up all configuration files and databases before applying the patch. Monitor for any unexpected changes in system behaviour after the update. This approach minimises downtime and ensures a smooth transition to the secured version.

What to do and how to stay safe: Hestia Control Panel

• Audit user accounts to identify any low-privileged users who could potentially exploit the search feature.
• Implement network segmentation to restrict access to the control panel from untrusted sources.
• Monitor system logs for unusual activity, particularly related to path manipulation or unauthorized root access.
• Once the vendor provides an update, apply it promptly to all affected systems.

Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Hestia Control Panel are affected?

Versions 1.9.7 through 1.10.4 are affected by this vulnerability.

Is there a fix available?

Yes, version 1.10.5 fixes the vulnerability.

What is the CVSS score for this vulnerability?

The CVSS score is 9.9, which is rated as critical.