CVE-2026-108390

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

CVE-2026-108390

Hestia Control Panel versions 1.9.7 through 1.10.4 are vulnerable to a local privilege escalation flaw. The update_object_value() function in func/main.sh fails to escape single quotes when writing custom document-root values to a user's web.conf file. This allows a low-privileged authenticated u...

CVE-2026-108390

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

PT-2026-114012

Name of the Vulnerable Software and Affected Versions Hestia Control Panel versions 1.9.7 through 1.10.4 Description A low-privileged authenticated user with a web domain can execute arbitrary code as root. The issue occurs because the update object value function in func/main.sh fails to escape...

CVE-2026-108390: Improper Neutralization of Argument Delimiters in a Command

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...