SB2026073068 - Multiple vulnerabilities in Hestia Control Panel
Published: July 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper Authorization (CVE-ID: N/A)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to take over the root_user account.
The vulnerability exists due to improper authorization in web/edit/user/index.php when handling direct requests to edit the root_user account after $_SESSION["look"] is normalized in web/inc/main.php. A remote privileged user can submit a crafted request to change the root_user account password to take over the root_user account.
The issue affects non-ROOT_USER accounts with ROLE=admin, and no additional ownership check is performed on the POST path beyond a valid session CSRF token.
2) OS Command Injection (CVE-ID: N/A)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary commands as root.
The vulnerability exists due to improper neutralization of special elements used in an os command in the Restic incremental-restore scheduler and backup queue processing when scheduling a restore operation with crafted parameters. A remote user can send a specially crafted request to execute arbitrary commands as root.
Exploitation requires a valid authenticated panel session and the injected command runs when the scheduled backup queue job is processed, normally within 5 minutes.
3) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: N/A)
CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator's browser.
The vulnerability exists due to improper neutralization of script-related html content in the notification panel rendering in web/templates/includes/panel.php when rendering stored notification content through x-html. A remote user can create a crafted notification to execute arbitrary JavaScript in an administrator's browser.
User interaction is required because an administrator must view the affected user's notifications, such as during impersonation of a non-admin account.
Remediation
Install update from vendor's website.