Hestia Panel Users Can Escalate to Root via Search Feature

Hestia Control Panel versions 1.9.7 through 1.10.4 contain a critical privilege escalation flaw. The issue allows a low-privileged user to execute arbitrary code with root permissions.

What happened

The vulnerability exists in the `update_object_value()` function within `func/main.sh`. According to the National Vulnerability Database record for CVE-2026-108390, this function fails to escape single quotes when writing custom document-root values to a user's `web.conf` file. This oversight enables an authenticated panel user with a web domain to inject an additional PATH field into the configuration.

When the user invokes the standard Search feature, the system executes the `v-search-user-object` script. This script runs with root privileges. It loads the forged field through `parse_object_kv_list_non_eval()`, which permits reserved shell-variable names. The process globally replaces the PATH variable before invoking the `column` command without an absolute path.

An attacker can place a malicious executable named `column` in the injected search path. When the script calls `column`, it executes the attacker's code instead of the legitimate utility. This results in arbitrary code execution as root. The flaw was introduced in version 1.9.7 when the vendor replaced a raw `eval` sink previously addressed by CVE-2026-84984 with `parse_object_kv_list_non_eval()`.

Why it matters

This issue is rated Critical with a CVSS score of 9.9. It affects a wide range of versions, from 1.9.7 through 1.10.4. The vulnerability leverages existing, legitimate functionality—the Search feature—to achieve full system compromise.

The weakness is associated with CWE-88, CWE-94, and CWE-427. The residual nature of the flaw means it emerged from a previous mitigation attempt. Users who patched CVE-2026-84984 may have assumed their environment was secure, but this new vector remains in versions prior to 1.10.5.

Our take on the response

• Upgrade Hestia Control Panel to version 1.10.5 immediately, as this version fixes the vulnerability.
• Audit `web.conf` files for unexpected PATH variables or injected single quotes.
• Monitor logs for unusual invocations of the `v-search-user-object` script.
• Verify that the `column` command is called with an absolute path in custom scripts.

What defenders should look for

Teams usually detect this activity by monitoring for unexpected process executions from the `v-search-user-object` script. Check whether the script invokes binaries that are not located in standard system directories. Look for alerts related to the creation of new executables in user-controlled directories. Review configuration files for anomalous PATH entries or unescaped quotes. Contain the incident by isolating affected servers and disabling user access to the panel until patched.

What to do and how to stay safe: Hestia Control Panel

• Update Hestia Control Panel to version 1.10.5 to apply the vendor-provided fix.
• Inspect web configuration files for injected PATH variables or malformed entries.
• Monitor system logs for unauthorized executions of the `column` command.
• Restrict user permissions to prevent modification of critical configuration files.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Hestia Control Panel are affected by CVE-2026-108390?

Versions 1.9.7 through 1.10.4 are affected. Version 1.10.5 fixes the issue.

How does an attacker exploit this vulnerability?

An attacker injects a PATH field via the Search feature, causing the root script to execute a malicious `column` binary.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-108390 as Critical with a CVSS score of 9.9.