External risk intelligence

Hestia Control Panel Path Traversal Vulnerability Allows Root Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-108390

Hestia Control Panel is a web-based hosting management application designed to be internet-facing for the administration of web domains and server configurations. Because it is a centralized management portal typically exposed to the internet to allow administrators and users to manage web services, the vulnerable interface is commonly deployed in an internet-facing configuration.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Hestia Control Panel, affecting how it handles custom document-root values, which could allow a low-privileged user to execute arbitrary code with root privileges. This issue arises from improper handling of single quotes when writing to configuration files, leading to a PATH injection that can be exploited when the search feature is used.

Unescaped quotes allow code execution.
Affects web hosting control, potentially critical systems.
Confirm relevance and investigate exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access to the Hestia Control Panel can inject a malicious path into a web domain's configuration. When the system's search feature is used, this injected path can cause a script to execute arbitrary commands with root privileges, potentially leading to full system compromise.

Requires authenticated panel user access.
Triggered by the ordinary Search feature.
Risk of arbitrary code execution as root.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged authenticated user with a web domain could potentially execute arbitrary code as root when the search feature is used. This occurs because an improper handling of single quotes in a custom document-root value allows for the injection of a malicious PATH field into a configuration file. When the search script is invoked, it can then load this forged field, leading to the execution of a malicious command.

System configuration data at risk.
Arbitrary code execution via crafted search path.
Root-level access to the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Hestia Control Panel's `update_object_value()` function in `func/main.sh` is vulnerable, potentially impacting application owners and infrastructure teams responsible for its deployment and management. The immediate priority is to identify all instances of Hestia Control Panel, determine their reachability and business criticality, and confirm the accountable owner for each. Subsequent remediation planning should be risk-based.

Application and infrastructure teams own remediation.
Verify Hestia Control Panel reachability and criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Hestia Control Panel?

Hestia Control Panel is a web-based management interface that simplifies hosting tasks like managing domains, email accounts, databases, and server settings. It acts as a centralized dashboard for web administrators to configure and maintain the underlying server infrastructure without needing to manage every service manually.

How does CVE-2026-108390 cause a security issue?

This vulnerability involves improper input validation, categorized as Argument Injection (CWE-88) and Uncontrolled Search Path Element (CWE-427). Because the panel fails to properly escape single quotes when saving custom document-root settings, a user can inject a malicious PATH variable. This allows the system to be tricked into running a attacker-controlled file instead of a legitimate system tool when the search feature is triggered, resulting in code execution with root privileges.

When does this vulnerability trigger?

The flaw is triggered specifically when a low-privileged user with a web domain saves a crafted document-root value and subsequently executes the panel's built-in Search function. It is not triggered by simply having the software installed; it requires an attacker to actively authenticate to the panel and perform these specific configuration and search actions.

Do I need to worry about this if my panel is not public?

Yes, but your risk profile varies. Halo Surface Signal identifies Hestia Control Panel as a management application typically designed for internet-facing deployment, which increases the likelihood of remote access. While internal-only deployments have a smaller attack surface, the vulnerability remains a significant risk if any untrusted or low-privileged user account can access the panel's interface.

What should I do to address this risk?

First, verify your current Hestia Control Panel version to see if it falls between 1.9.7 and 1.10.4. If you are running an affected version, the primary step is to update the software to version 1.10.5 or later, which includes the necessary changes to safely handle configuration values and resolve the path injection weakness.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.