CVE-2026-108390

Name of the Vulnerable Software and Affected Versions Hestia Control Panel versions 1.9.7 through 1.10.4

Description A low-privileged authenticated user with a web domain can execute arbitrary code as root. The issue occurs because the update object value() function in func/main.sh fails to escape single quotes when writing a custom document-root value to a user's web.conf file, enabling the injection of an additional PATH field. When the Search feature is used, the root-privileged v-search-user-object script loads this forged field via parse object kv list non eval(), which allows reserved shell-variable names and replaces the global PATH before calling the column command without an absolute path. An attacker can exploit this by placing a malicious column executable in the injected search path.

Recommendations Update to version 1.10.5.