9.9 CVSS: Hestia Panel Search Flaw Allows Root Code Execution in v1.9.7-1.10.4
A critical flaw in Hestia Control Panel allows authenticated users to execute code as root by exploiting the search feature.
Key points
- The vulnerability affects Hestia Control Panel versions 1.9.7 through 1.10.4.
- It carries a CVSS score of 9.9, rated as critical severity.
- An update to version 1.10.5 patches the issue.
Hestia Control Panel contains a critical flaw that allows authenticated users to gain full root access on the server by abusing the search function.
The risk
National Vulnerability Database records identify this issue as CVE-2026-108390 with a CVSS score of 9.9. The weakness stems from improper handling of single quotes in the `update_object_value()` function within `func/main.sh`. This allows users to inject malicious data into configuration files.
Who is exposed
Any system running Hestia Control Panel from version 1.9.7 up to but not including 1.10.5 is affected. Users with low-privileged accounts who have a web domain configured are the primary vectors for exploitation.
Cost and compliance
No financial impact data is provided in the source material. Compliance implications depend on how organizations classify root privilege escalation risks within their specific security frameworks and audit requirements.
What should you do?
Administrators should verify their current Hestia version immediately. If running a vulnerable version, apply the update to 1.10.5 without delay. Monitor logs for unusual search activity or unexpected process executions.
The background in plain language
Control panels manage server settings through web interfaces. Privilege escalation occurs when a user gains higher access rights than intended. Path injection involves manipulating system directories so the server runs malicious programs instead of legitimate ones. Teams usually restrict who can modify system paths. Check whether your panel allows untrusted input to influence command execution environments.
What to do and how to stay safe: Hestia Control Panel
- Verify your Hestia Control Panel version against the affected range.
- Update to version 1.10.5 once available to patch the flaw.
- Review user permissions to ensure only trusted accounts have domain access.
- Monitor system logs for unauthorized execution of commands.
Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Hestia Control Panel are vulnerable?
Versions 1.9.7 through 1.10.4 are affected by this vulnerability.
What is the severity rating of CVE-2026-108390?
The National Vulnerability Database rates it as critical with a CVSS score of 9.9.
Is there a fix available for this issue?
Yes, the vulnerability is fixed in version 1.10.5 of Hestia Control Panel.
