CVE-2026-111627
HighCVSS 7.2Summary
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
Risk Assessment
An attacker with administrator privileges can execute arbitrary commands as the ROOT_USER account, leading to full server compromise and privilege escalation. This poses a serious threat to confidentiality, integrity, and availability of the hosting environment.
Recommendation
Upgrade HestiaCP to version 1.10.5 or later. Until patched, restrict panel access and verify that the read-only flag is enforced for non-ROOT_USER accounts.
Other vulnerabilities in HestiaCP
See all- CVE-2026-43633Critical
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js. This allows unauthenticated remote attackers to achieve root-level code execution by injecting crafted data into HTTP headers.
- CVE-2025-30008Medium
HestiaCP before version 1.9.5 has a stored cross-site scripting vulnerability. Authenticated low-privilege users can inject arbitrary HTML/JavaScript by creating a DNS record with a double quote and script payload in the value field. The application fails to encode the value with htmlspecialchars() in list_dns_rec.php, allowing the payload to execute in browsers of other users, including administrators.
- CVE-2025-30007High
HestiaCP before version 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_dns_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.
- CVE-2026-12196High
HestiaCP panel contains a broken access control vulnerability in the cronjob feature. Low privilege users can modify panel cronjobs to execute HestiaCP management scripts with passwordless sudo.
- CVE-2026-43634High
HestiaCP versions 1.2.0 through 1.9.4 have an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP header without verifying the request originated from Cloudflare.
Original NVD description (English source)
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS