Eval Injection in Hestia Control Panel - #VU140556
Published: July 30, 2026
Vulnerability identifier: #VU140556
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-95
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as root.
The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the parse_object_kv_list() function in func/main.sh when parsing user-controlled configuration data. A remote user can store a crafted payload in a cron job command, DNS TXT record, or mail forward address to execute arbitrary code as root.
The issue is triggered because data is evaluated twice, including once in the calling root shell, and cron job exploitation may occur during the next cron rebuild cycle without user interaction.
Affected software
Hestia Control Panel
Remediation
Install security update from vendor's website.
Hestia Control Panel - update to 1.9.5