CVE-2026-108390

Summary

A vulnerability in Hestia Control Panel allows low-privileged users to inject malicious PATH values into web configuration files, which can then be executed as root during search operations. This creates a critical privilege escalation vector from user-level access to full system control.

Exploitability

Exploitation requires a low-privileged authenticated user with domain access and the ability to trigger the search feature, making it moderately difficult but feasible in environments where users have web hosting privileges.

Blast radius

The vulnerability could affect any Hestia Control Panel instance running versions 1.9.7 through 1.10.4, potentially allowing attackers to gain root access across multiple user accounts and systems.

Detection

Monitor for unusual PATH environment variable usage in v-search-user-object processes, particularly when invoked by non-root users, and watch for execution of unexpected binaries named 'column' in root context.

Prioritized remediation

Upgrade to version 1.10.5 immediately to remediate this critical privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.