Link following in Hestia Control Panel - #VU164473
Published: November 10, 2026
Vulnerability identifier: #VU164473
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify or delete data outside their account and cause a denial of service.
The vulnerability exists due to improper link resolution in Hestia Control Panel restore commands when performing root-level cleanup and copy operations without checking user-controlled paths for symbolic links or unexpected ownership. A remote user can manipulate paths inside their home directory and request restoration of their own backup to redirect privileged file operations outside their account.
Affected software
Hestia Control Panel
Remediation
Install security update from vendor's website.
Hestia Control Panel - update to 1.10.6