Hestia Control Panel Root Privilege Escalation Vulnerability

Hestia Control Panel versions 1.9.7 through 1.10.4 contain a root privilege escalation vulnerability in the update_object_value() function in func/main.sh.

The function does not escape single quotes when writing a custom document-root value to a user's web.conf file. A low-privileged authenticated panel user with a web domain can inject an additional PATH field.

When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root.

• Affected versions: 1.9.7 through 1.10.4
• Fixed in: 1.10.5
• Residual vulnerability introduced when 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval()