SB2026091615 - Multiple vulnerabilities in Hestia Control Panel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091615

SB2026091615 - Multiple vulnerabilities in Hestia Control Panel

Published: September 16, 2026

Security Bulletin ID SB2026091615
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Not Failing Securely ('Failing Open') (CVE-ID: N/A)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to failure to terminate control flow after a redirect in the top_panel() function in web/inc/main.php when handling requests from suspended users with active sessions. A remote user can request the user-management page to disclose sensitive information.

The response body can contain usernames, email addresses, packages, disk and bandwidth quotas, and suspension status for all accounts.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to retain administrative capabilities after demotion.

The vulnerability exists due to improper authorization based on a stale session role in redirect-only administrative handlers when using a pre-demotion panel session after a role change. A remote privileged user can send requests to the affected handlers to retain administrative capabilities after demotion.

The affected handlers include user deletion, user suspension, bulk user operations, and service restart operations.


3) Insecure DLL loading (CVE-ID: N/A)

CWE-ID: CWE-427 - Uncontrolled Search Path Element

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code as root.

The vulnerability exists due to improper neutralization of single quotes and insufficient reserved-variable validation in update_object_value() and parse_object_kv_list_non_eval() when a crafted custom document root is written to and re-parsed from a web configuration file. A remote user can set a crafted document root and trigger the Search feature to execute an attacker-controlled program as root.

The affected Search path invokes the column command without an absolute path after the configuration values are re-parsed.


4) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands in the protected administrator account\'s context.

The vulnerability exists due to incorrect authorization in the cron job creation endpoint when handling cron job creation requests while impersonating the protected administrator account. A remote privileged user can impersonate the protected administrator account and submit a cron job creation request to execute arbitrary commands in the protected administrator account\'s context.


Remediation

Install update from vendor's website.

References