CVE-2026-108390

Deferred Deferred - Pending Action

Path Traversal in Hestia Control Panel

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108390

EUVD

EUVD-2026-101308

Affected Vendors & Products

Vendor	Product	Version / Range
hestiacp	hestiacp	>= 1.9.7, < 1.10.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Executive Summary

CVE-2026-108390 is a critical vulnerability in Hestia Control Panel versions 1.9.7 through 1.10.4. It allows a low-privileged authenticated user to inject malicious PATH variable assignments into configuration files by exploiting unescaped single quotes in directory names. When the user performs a routine search, the system executes a malicious executable named 'column' from the attacker-controlled directory as root.

Detection Guidance

Check HestiaCP version with 'v-list-sys-hestia-all' or 'dpkg -l hestia'. If version is below 1.10.5, the system is vulnerable. Inspect web.conf files for malicious PATH entries or single quotes in document root values.

Impact Analysis

This vulnerability allows an attacker with a standard user account to escalate privileges to root access on the server. It enables complete server compromise, affecting all tenants and data on the host. The attack requires no admin interaction and takes effect immediately upon triggering the search feature.

Compliance Impact

This vulnerability allows a low-privileged user to escalate privileges to root access, potentially compromising the entire server. Such a breach could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. The lack of proper input validation and escaping mechanisms directly undermines compliance with these standards.

Mitigation Strategies

Upgrade HestiaCP to version 1.10.5 or later immediately. Review and remove any suspicious PATH entries in web.conf files. Audit user-created directories for names containing single quotes or reserved variables.

Hi! I’m here to help you understand CVE-2026-108390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70