Description

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-14T18:17:27.180Z",
  "pubdate": "2026-10-14T18:17:27.180Z",
  "executiveSummary": "Hestia Control Panel (versions 1.9.7 through 1.10.4) contains a critical security vulnerability involving improper input validation that leads to privilege escalation. The flaw resides in the update_object_value() function within func/main.sh, which fails to sanitize single quotes when updating user web domain configurations.\nThis vulnerability allows an authenticated, low-privileged user to inject arbitrary PATH environment variables into a user's web.conf file. When the administrative v-search-user-object script—which operates with root privileges—subsequently parses this configuration using parse_object_kv_list_non_eval(), it inadvertently processes the malicious PATH variable. By manipulating the system search path, an attacker can trick the script into executing a malicious 'column' binary placed in a user-controlled directory.\nSuccessful exploitation results in arbitrary code execution with root privileges, representing a complete system compromise. The vulnerability is a consequence of an incomplete fix for a previously identified issue (CVE-2026-84984), where the transition to a non-eval parsing method introduced a new vector for environment variable manipulation. This issue is fully resolved in version 1.10.5.",
  "technicalDetails": "The vulnerability originates in func/main.sh within the update_object_value() function, which is responsible for persisting custom document-root values to a user’s web.conf file. The function fails to implement sufficient input sanitization, specifically lacking an escape mechanism for single quotes. This oversight enables an authenticated low-privileged user to break out of the intended configuration context and inject arbitrary key-value pairs into the web.conf file.\nThe attack vector leverages the interaction between the compromised web.conf file and the administrative v-search-user-object script. This script executes with root privileges and utilizes the parse_object_kv_list_non_eval() function to process user objects. While intended to prevent direct code execution via eval(), parse_object_kv_list_non_eval() does not adequately restrict the injection of reserved shell-variable names. Crucially, it globally replaces the PATH environment variable based on the values retrieved from the configuration file.\nThe exploitation flow proceeds as follows: First, the attacker uses the panel's interface to update a web domain’s document-root, inserting a malicious string containing a new PATH definition. Second, the attacker places a malicious, executable binary named 'column' within a directory of their choosing (e.g., in a directory they have write access to). Third, the attacker triggers the Search feature within the Hestia Control Panel. When v-search-user-object is invoked as root, it reads the poisoned web.conf file. The parse_object_kv_list_non_eval() function processes the malicious configuration, overwriting the system's PATH variable to prioritize the attacker's directory.\nBecause v-search-user-object invokes the system 'column' command without an absolute file path, the shell utilizes the modified PATH, locating the attacker’s malicious binary instead of the legitimate utility. Consequently, the attacker's code is executed with root-level privileges. This residual vulnerability persists due to the logical flaw in how the parsing function handles environment variable overrides, effectively turning a configuration persistence issue into a full command injection primitive. The attack requires initial authentication as a panel user with an active web domain, but it requires no further interaction once the configuration is injected and the search is performed."
}