hestiacp vulnerabilities
CVEs whose affected-version data names the hestiacp package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111627High· 7.2PoCHestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter a…
▾ Midnighthestiacp · hestiacpvia CVEORG
CVE-2026-108390Critical· 9.9PoCHestia Control Panel is a lightweight and powerful control panel for the modern web
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a us…
▾ Abyssalhestiacp · hestiacpvia NVD