CVE-2021-30070

Name of the Vulnerable Software and Affected Versions HestiaCP versions prior to 1.3.5

Description An issue was discovered in HestiaCP where attackers can arbitrarily install packages due to values taken from the pgk parameter in the update request being transmitted to the operating system's package manager.

Recommendations For versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the package manager or disabling the update request functionality until a patch is applied. Avoid using the pgk parameter in the update request until the issue is resolved.