CVE-2026-108390 in Hestia Control Panel
Summary
by MITRE • 10/14/2026
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
Hestia Control Panel, a widely used web hosting management interface, contains a critical privilege escalation vulnerability affecting versions from 1.9.7 through 1.10.4. This flaw resides within the update_object_value function located in the main.sh script of the application's backend logic. The core technical deficiency is an insufficient input validation and sanitization mechanism when handling user-supplied data for custom document-root configurations. Specifically, the system fails to properly escape single quotes during the process of writing these values into a user-specific web.conf configuration file. This lack of proper escaping allows an authenticated attacker with low-privileged access who possesses at least one configured web domain to manipulate the structure of this configuration file by injecting additional fields that were not intended by the application logic.
The exploitation chain begins when the affected system utilizes its built-in search functionality, which triggers the execution of a root-privileged script named v-search-user-object. This script is responsible for processing user queries and relies on parsing the web.conf files to determine relevant paths and contexts. It employs a function called parse_object_kv_list_non_eval to interpret key-value pairs from these configuration files. Although this function was introduced in version 1.9.7 as a mitigation against a previous arbitrary code execution vulnerability identified as CVE-2026-84984, it inadvertently retained a dangerous flaw: it permits the injection of reserved shell variable names into the environment context. By injecting a crafted PATH field via the unescaped single quotes in the web.conf file, an attacker can manipulate the system's search path for executable commands during the execution of this privileged script.
Once the malicious PATH value is loaded by parse_object_kv_list_non_eval(), it results in a global replacement or modification of the environment variable before critical utilities are invoked. The specific utility affected is column, which is called without an absolute path within the v-search-user-object script. This absence of an absolute path creates a classic command injection vector known as PATH hijacking. Because the attacker-controlled PATH value takes precedence over standard system directories like /usr/bin or /bin, any executable placed in one of the injected search paths will be executed instead of the legitimate column utility. Consequently, if an attacker places a malicious script disguised as the column binary within their controlled directory listed in the forged PATH variable, that code will execute with root privileges when the search feature is triggered by any user or system process invoking this functionality.
The operational impact of this vulnerability is severe, resulting in full remote code execution as the root user on the affected server. This grants an attacker complete control over the underlying operating system, enabling them to install backdoors, exfiltrate sensitive data from all hosted websites and databases managed by Hestia Control Panel, pivot to other internal network resources, or disrupt service availability for all customers sharing the infrastructure. The vulnerability represents a significant security regression because it emerged as a residual flaw after developers attempted to patch an earlier critical issue involving raw eval sinks. This highlights the risks associated with complex refactoring efforts where new sanitization layers may inadvertently introduce different classes of injection vulnerabilities if they do not comprehensively address input validation across all execution paths.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-94 Improper Control of Generation of Code or Script. In the context of the MITRE ATT&CK framework, it maps to T1059 Command and Scripting Interpreter via shell commands and potentially T1203 Exploitation for Client Execution if leveraged through web interactions leading to system compromise. The attack vector is classified as Local Privilege Escalation because while initial access requires authentication, the escalation from a low-privileged panel user to root occurs locally within the server environment without requiring network-based exploitation of external services beyond the control panel interface itself.
Mitigation strategies must prioritize immediate upgrading to Hestia Control Panel version 1.10.5 or later, where this specific input validation flaw has been addressed by properly escaping single quotes and reinforcing the parsing logic in parse_object_kv_list_non_eval(). For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations include restricting file system permissions on web.conf files to prevent modification by low-privileged users if possible, although this may break legitimate functionality. Additionally, administrators should audit server configurations for any signs of unauthorized PATH modifications or suspicious executables in user-writable directories that could serve as payloads for the column binary hijacking technique. Regular monitoring of root-level process execution logs can also help detect exploitation attempts by identifying unexpected invocations of system utilities like column originating from web service contexts rather than standard administrative actions.