# CVE-2026-108390: Hestia Control Panel privilege escalation in custom document-root handling

Source: https://junglewise.ai/threats/cve-2026-108390-hestia-control-panel-is-a-lightweight-and-powerful-control-panel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108390 · Severity: critical · CVSS 9.9 · Published 2026-10-14

Hestia Control Panel is a lightweight web hosting control panel. A low-privileged authenticated user can create a specially-named directory and set it as a custom document root, injecting a malicious PATH variable into their configuration file. When the user runs the ordinary Search feature, a root-privileged script reloads this corrupted configuration and executes an attacker-controlled binary as root, enabling complete server compromise.

Technologies: [HestiaCP Hestia Control Panel](https://junglewise.ai/threats/technologies/hestia-control-panel). Vendors: [HestiaCP](https://junglewise.ai/threats/vendors/hestiacp).

## Quick answers

**Is CVE-2026-108390 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108390 being exploited in the wild.

**How severe is CVE-2026-108390?** Critical severity, with a CVSS score of 9.9, published 14 October 2026.

**Which products and versions are affected?** HestiaCP Hestia Control Panel 1.9.7 through 1.10.4.

**Is there a fix for CVE-2026-108390?** Yes: fixed in 1.10.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108390 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108390?** Check whether you run HestiaCP Hestia Control Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.5

## Technical details

The vulnerability chains two flaws in func/main.sh: update_object_value() fails to escape single quotes when writing custom document-root values to web.conf, allowing field injection; parse_object_kv_list_non_eval() then re-parses this file as root without checking for reserved shell variable names, silently overwriting PATH before invoking column without an absolute path. An authenticated panel user with a web domain can trigger this via the standard Search feature through a sudo-invoked root script, achieving arbitrary code execution as root.

## Affected products

- HestiaCP Hestia Control Panel 1.9.7 through 1.10.4

## Timeline

- 2026-09-15: disclosed
- 2026-10-14: advisory: CVE-2026-108390 published

## References

- [https://github.com/hestiacp/hestiacp/commit/4d86018660f35a1d64a0ae819bc5ee700949a287](https://github.com/hestiacp/hestiacp/commit/4d86018660f35a1d64a0ae819bc5ee700949a287)
- [https://github.com/hestiacp/hestiacp/security/advisories/GHSA-r9q4-pmcm-5qqf](https://github.com/hestiacp/hestiacp/security/advisories/GHSA-r9q4-pmcm-5qqf)

## Related threats

- [HestiaCP IP spoofing via CF-Connecting-IP header](https://junglewise.ai/threats/cve-2026-43634-hestiacp-ip-spoofing-via-cf-connecting-ip-header)
- [HestiaCP deserialization in web terminal component](https://junglewise.ai/threats/cve-2026-43633-hestiacp-deserialization-in-web-terminal-component)