CVE-2026-108390 Details
Description
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.
A local privilege escalation vulnerability has been identified in Hestia Control Panel, affecting versions 1.9.7 prior to 1.10.4. The issue arises in the 'func/main.sh' file, where the 'update_object_value()' function fails to properly escape single quotes when writing custom document root values to users' 'web.conf' files. This flaw allows low-privileged authenticated users to inject additional 'PATH' variables. When the 'v-search-user-object' script is executed, it loads the modified 'web.conf' data, including the injected 'PATH' variable, and replaces the default 'PATH' with the injected value. This exploitation enables the execution of arbitrary code as the root user.
Users are advised to update Hestia Control Panel to version 1.10.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hestiacp/hestiacp/security/advisories/GHSA-r9q4-pmcm-5qqf | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/hestiacp/hestiacp/commit/4d86018660f35a1d64a0ae819bc5ee700949a287 | [email protected] | Source CodeVendor |
| https://github.com/hestiacp/hestiacp/security/advisories/GHSA-r9q4-pmcm-5qqf | [email protected] | AdvisoryRemedyVendor |
| https://ravindulakmina.pages.dev/advisories/cve-2026-108390-hestiacp-apostrophe-to-root | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-427 | Uncontrolled Search Path Element | [email protected] |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hestia Control Panel | >= 1.9.7, <= 1.10.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | New CVE Received | [email protected] |
| Oct 14, 2026 | CVE Modified | CISA-ADP |