hestiacp has 4 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.0 (high), with 1 rated critical. Most affected products: control_panel (2), hestiacp (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.0
- Publish → KEV
- —
- Last 90 days
- 2 prev 2
Worst active — by depth score
CVE-2026-108390Critical· 9.9Hestia Control Panel is a lightweight and powerful control panel for the modern web67CVE-2026-111627High· 7.2HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account52CVE-2025-30007High· 8.8HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record type…49CVE-2025-30008Medium· 4.6HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value fiel…25
hestiacp vulnerabilities
CVEs affecting hestiacp, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-111627High· 7.2PoCHestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter a…
CVE-2026-108390Critical· 9.9PoCHestia Control Panel is a lightweight and powerful control panel for the modern web
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a us…
CVE-2025-30007High· 8.8HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record type…
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record type…
CVE-2025-30008Medium· 4.6HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value fiel…
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value fiel…