SB2026073064 - Multiple vulnerabilities in Hestia Control Panel
Published: July 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Code Injection (CVE-ID: N/A)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary commands as root.
The vulnerability exists due to improper control of code generation in v-search-user-object when parsing poisoned web.conf path fields with eval. A remote user can store a crafted path value in CUSTOM_DOCROOT, CUSTOM_PHPROOT, or FTP_PATH and trigger the panel Search feature to execute arbitrary commands as root.
The issue is reachable from a low-privileged panel account through the Search functionality, and no user interaction beyond the attacker's own actions is required.
2) SQL injection (CVE-ID: N/A)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary SQL statements with database administrative privileges.
The vulnerability exists due to sql injection in func/db.sh when processing user-supplied database passwords in database management operations. A remote user can supply a crafted password value to execute arbitrary SQL statements with database administrative privileges.
The issue affects both MySQL and PostgreSQL code paths and the injected SQL is processed in batch mode, allowing semicolon-separated statements to be executed.
3) Improper Authorization (CVE-ID: N/A)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper authorization in the admin panel crontab management endpoint when handling a manual POST request to save panel cronjobs. A remote user can submit a specially crafted request to overwrite or add a panel cronjob to escalate privileges.
The injected panel cronjob can execute Hestia scripts via sudo without a password, allowing takeover of the admin account after the scheduled job runs.
Remediation
Install update from vendor's website.