Description
Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hestia Control Panel | Hestia Control Panel | 1.3.3 | — |
References
- ExploitDB-49667 exploit
- Hestia Control Panel Official Homepage product
- Hestia Control Panel GitHub Repository product
- VulnCheck Advisory: Hestia Control Panel 1.3.2 - Arbitrary File Write third-party-advisory