CVE-2026-108390 Hestia Control Panel - Command Injection

Hestia Control Panel 1.9.7 through 1.10.4 contains a command injection caused by improper escaping of single quotes in update_object_value() when writing custom document-root values, letting low-privileged authenticated users execute code as root via a crafted PATH during the Search feature.

CVSS base score 9.9 /10
Critical
CISA KEV
Not listed
Public exploit
None known
Authentication
Required
View the NVD record ↗

Details

Type
Command Injection
Impact
Remote Code Execution, Privilege Escalation
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
14 October 2026
Updated
15 October 2026
Weakness
CWE-88

Vendor fix

Upgrade to version 1.10.5 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs