SB20261110334 - OS Command Injection in Hestia Control Panel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110334

SB20261110334 - OS Command Injection in Hestia Control Panel

Published: November 10, 2026

Security Bulletin ID SB20261110334
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands as root and escalate privileges.

The vulnerability exists due to improper neutralization of command metacharacters in Hestia Control Panel's custom document root processing when inserting directory paths into privileged sed substitution expressions. A remote user can create a directory named 'x;cd ~demouser;id>x|e; #' and select it as the custom document root to trigger sed's execution flag and execute commands as root.


Remediation

Install update from vendor's website.

References