Browse all 19 CVE security advisories affecting hestiacp. AI-powered Chinese analysis, POCs, and references for each vulnerability.
HestiaCP serves as a web hosting control panel designed to simplify server management for web hosting providers and developers. Historically, the platform has been susceptible to multiple remote code execution (RCE) vulnerabilities, cross-site scripting (XSS) flaws, and privilege escalation issues, with 13 CVEs documented to date. Notable security characteristics include its open-source nature and frequent updates, though past incidents have demonstrated that misconfigurations or unpatched installations could lead to complete server compromise. The platform's widespread adoption in shared hosting environments makes it a target for automated attacks, emphasizing the need for timely patching and hardening of default configurations.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-108390 | HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking — hestiacp CWE-88 | 9.9 | Critical | 2026-10-14 |
| CVE-2025-30008 | HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface — hestiacp CWE-79 | 4.6 | Medium | 2026-07-10 |
| CVE-2025-30007 | HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management — hestiacp CWE-78 | 8.8 | High | 2026-07-10 |
| CVE-2026-12196 | HestiaCP Admin Takeover — hestiacp CWE-287 | - | - | 2026-07-04 |
| CVE-2026-43634 | HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header — hestiacp CWE-348 | 7.5 | High | 2026-05-19 |
| CVE-2026-43633 | HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal — hestiacp CWE-502 | 10.0 | Critical | 2026-05-19 |
This page lists every published CVE security advisory associated with hestiacp. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.