hestiacp Hestia Control Panel up to 1.10.4 Search Feature func/main.sh update_object_value untrusted search path

Summaryinfo

A vulnerability was found in hestiacp Hestia Control Panel up to 1.10.4. It has been classified as critical. Affected is the function update_object_value of the file func/main.sh of the component Search Feature. Performing a manipulation results in untrusted search path. This vulnerability was named CVE-2026-108390. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in hestiacp Hestia Control Panel up to 1.10.4. It has been classified as critical. This affects the function update_object_value of the file func/main.sh of the component Search Feature. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-108390 since 10/09/2026. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Upgrading to version 1.10.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• hestiacp

Name

• Hestia Control Panel

Version

• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion