Skip to content
OpenAdvisories

Vendor

hestiacp

20 known vulnerabilities.

Products

hestiacp/hestiacp 13 hestiacp 7
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-108390

    HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

    Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, al…

    hestiacp hestiacp
  • Critical 10.0
    CVE-2026-43633

    HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

    HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attacker…

    hestiacp hestiacp
  • Critical 9.1
    CVE-2022-2626

    Incorrect Privilege Assignment in hestiacp/hestiacp

    Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.

    hestiacp hestiacp/hestiacp
  • Critical 9.9
    CVE-2022-2550 EPSS 49%

    OS Command Injection in hestiacp/hestiacp

    OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.

    hestiacp hestiacp/hestiacp
  • Critical 9.9
    CVE-2022-1509

    Command Injection Vulnerability in hestiacp/hestiacp

    Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.

    hestiacp hestiacp/hestiacp