Hestiacp vulnerabilities
We track 7 vulnerabilities in Hestiacp products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Hestiacp vulnerabilities
- 7.2 High severity
hestiacp: Incorrect Authorization
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/,
- 9.9 Critical severity
hestiacp: Improper Neutralization of Argument Delimiters in a Command
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, all
- 8.8 High severity
hestiacp: Improper Neutralization of Special Elements used in an OS Command
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploi
- 8.3 High severity
hestiacp: Improper Authentication
HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator user
- 7.5 High severity
hestiacp: Use of Less Trusted Source
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the re
- 10.0 Critical severity
hestiacp: Deserialization of Untrusted Data
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers
- 8.8 High severity
hestiacp/hestiacp: Improper Neutralization of Special Elements used in a Command
Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.