Which versions of HestiaCP are affected by CVE-2026-43633?

HestiaCP versions 1.9.0 through 1.9.4 contain a critical vulnerability in the web terminal feature that allows unauthenticated remote attackers to achieve root-level command execution without…. A patch is available.

How to fix or mitigate CVE-2026-43633?

Within 24 hours: Identify all systems running HestiaCP 1.9.0-1.9.4 and determine which have the web terminal feature enabled. Within 7 days: Deploy the vendor patch for CVE-2026-43633 across all affected instances, or disable the web terminal feature as an interim measure. Within 30 days: Audit all systems for signs of unauthorized access or malicious activity and verify full patch compliance.

HestiaCP CVE-2026-43633

Q: What is the CVSS score of CVE-2026-43633?

CVE-2026-43633 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-30933 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-19 VulnCheck

GHSA-p57r-8pg4-2892

Deserialization PHP Node.js RCE Hestiacp

9.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 14:30 vuln.today

Analysis Generated

May 19, 2026 - 14:30 vuln.today

CVSS changed

May 19, 2026 - 14:22 NVD

10.0 (CRITICAL) 9.5 (CRITICAL)

DescriptionCVE.org

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.

AnalysisAI

Unauthenticated root-level remote code execution affects HestiaCP versions 1.9.0 through 1.9.4 when the optional web terminal feature is enabled, stemming from a session-handling format mismatch (CWE-502) between the PHP backend and the Node.js web terminal. Remote attackers can inject crafted HTTP header data that PHP writes into session storage but Node.js parses with naive string splitting, yielding arbitrary command execution as root; no public exploit identified at time of analysis, though VulnCheck has published a technical advisory and the upstream patch is publicly diffable.

Technical ContextAI

HestiaCP is an open-source Linux web hosting control panel. Its optional web terminal ships as a Node.js WebSocket server (src/deb/web-terminal/server.js) that reuses the PHP control panel's filesystem session store. The pre-patch Node.js code read /data/sessions/sess_<id> directly and extracted the authenticated username with brittle substring parsing such as session.split('user|s:')[1].split('"')[1] against PHP's serialized session format. Because PHP's session handler will persist attacker-controllable request data (notably the spoofable client IP/header values that PHP serializes into the session file) and the Node.js side never validated session integrity, an attacker can poison the serialized blob with synthetic 'user|s:' tokens that the Node parser treats as a trusted username, which is then passed into a shell command executed as root. This is a classic deserialization-trust-boundary failure (CWE-502) compounded by mixing two languages' session encodings. The fix replaces the ad-hoc string split with a dedicated PHP helper (web-terminal-session-auth.php) invoked via execFileSync that performs a proper session_start() and returns JSON, and additionally hardens cookie parsing so duplicate or malformed HESTIASID cookies are rejected.

RemediationAI

Upgrade HestiaCP to the version containing fix commit 854d71b3c1737b0a0d0cc55c926008ffe1f6719b (merged via PR https://github.com/hestiacp/hestiacp/pull/5244); a vendor-released patched build is available per the project's release channel, and operators should track the GitHub release tagged after 1.9.4 for the exact version string. Until the upgrade is applied, disable the web terminal feature in the HestiaCP admin panel - this fully eliminates the attack surface at the cost of removing browser-based shell access for administrators. As a partial network-layer compensating control, restrict access to the HestiaCP management port (default 8083) and the web terminal WebSocket endpoint to a trusted management VLAN or VPN using iptables/ufw, accepting the trade-off that admins lose remote console access from arbitrary networks. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/hestiacp-deserialization-rce-via-web-terminal) and the upstream issue (https://github.com/hestiacp/hestiacp/issues/5229) for detection guidance; note that CVE-2026-43634 (IP spoofing) is referenced alongside this issue and should be remediated together.