Hestia Control Panel: Local privilege escalation to root via config injection

Summary

Hestia Control Panel versions 1.9.7 through 1.10.4 do not escape single quotes when writing a custom document root to a user's web.conf file. An authenticated low-privileged panel user with a web domain can inject a PATH field, and when the Search feature runs the root-privileged v-search-user-object script, a malicious executable named column in the injected path is run as root. Successful exploitation gives the attacker full control of the server.

Affected

• Hestia Control Panel 1.9.7 through 1.10.4
• Versions >= 1.9.7 and < 1.10.5

Fixed in

• Hestia Control Panel 1.10.5

Workaround

Unknown.

Exploitation

• Requires an authenticated panel account with a web domain (low privileges).
• CISA SSVC lists exploitation status as PoC; a public write-up exists.
• No reports of active exploitation found; CISA KEV status not verified.

Our recommendation

• Update Hestia Control Panel to version 1.10.5 or later on all affected servers.
• Until patched, restrict or disable untrusted user accounts that have web domains.
• Audit web.conf files for unexpected PATH entries and check for unexpected root processes or modified binaries in user web paths.
• Review which customers hold panel accounts and treat shared hosting setups as high priority.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-r9q4-pmcm-5qqf github.com
• Fix commit 4d86018 github.com
• Researcher advisory ravindulakmina.pages.dev
• Hestia 1.10.5 release github.com
• OSV entry CVE-2026-108390 osv.dev
• OpenCVE CVE-2026-108390 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:20.