CVE-2026-108390

Hestia Control Panel versions 1.9.7 through 1.10.4 are vulnerable to a local privilege escalation flaw. The update_object_value() function in func/main.sh fails to escape single quotes when writing custom document-root values to a user's web.conf file. This allows a low-privileged authenticated u...