SQL injection in Hestia Control Panel - #VU140554
Published: July 30, 2026
Vulnerability identifier: #VU140554
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL statements with database administrative privileges.
The vulnerability exists due to sql injection in func/db.sh when processing user-supplied database passwords in database management operations. A remote user can supply a crafted password value to execute arbitrary SQL statements with database administrative privileges.
The issue affects both MySQL and PostgreSQL code paths and the injected SQL is processed in batch mode, allowing semicolon-separated statements to be executed.
Affected software
Hestia Control Panel
Remediation
Install security update from vendor's website.
Hestia Control Panel - update to 1.9.7