OS Command Injection in Hestia Control Panel - #VU164470
Published: November 10, 2026
Vulnerability identifier: #VU164470
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands as root and escalate privileges.
The vulnerability exists due to improper neutralization of command metacharacters in Hestia Control Panel's custom document root processing when inserting directory paths into privileged sed substitution expressions. A remote user can create a directory named 'x;cd ~demouser;id>x|e; #' and select it as the custom document root to trigger sed's execution flag and execute commands as root.
Affected software
Hestia Control Panel
Remediation
Install security update from vendor's website.
Hestia Control Panel - update to 1.0.6