Hestia Control Panel EUVD-2026-101308

Requires: (1) a valid authenticated Hestia panel account at only low privilege (PR:L), (2) the user owning at least one web domain so they can write a custom document-root value, (3) injecting a single quote into that document-root value - unescaped by update_object_value() in func/main.sh - to append an attacker-controlled PATH field to the user's web.conf, and (4) invoking the panel's standard Search feature, which runs the root-privileged v-search-user-object script that loads the forged field via parse_object_kv_list_non_eval() (which permits reserved shell-variable names like PATH) and then calls 'column' without an absolute path. The attacker must also stage a malicious 'column' executable within the injected search path. Limiting factors that reduce real-world exposure: exploitation is confined to affected versions 1.9.7-1.10.4; it is unavailable to fully anonymous attackers (a provisioned account with web-domain capability is mandatory), making multi-tenant/shared-hosting and malicious-insider scenarios the realistic threat model; no end-user interaction by an admin is needed since the low-priv attacker triggers Search themselves.

This is a genuine high-priority vulnerability, not a CVSS-inflated paper risk. The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) is internally consistent with the description: a low-privileged but authenticated panel user (PR:L) reaches a root-privileged script over the network, with a scope change (S:C) from the panel user context to full host root - a textbook privilege-escalation-to-RCE. The attack complexity is genuinely low (AC:L): the only prerequisite is owning a web domain and supplying a single quote in a document-root value, with no race or special timing. No EPSS score, CISA KEV entry, or explicit POC flag was provided in the input, so exploitation-probability and in-the-wild signals are ABSENT rather than low - this should be read as 'unmeasured,' not 'safe.' The third-party reference (ravindulakmina.pages.dev) and the public vendor security advisory (GHSA-r9q4-pmcm-5qqf) with a full commit diff mean the mechanism is openly documented and readily reproducible by a skilled analyst, which materially raises practical exploitability even though no packaged exploit is confirmed. A notable aggravating factor: this is a RESIDUAL flaw - the description states v1.9.7's parse_object_kv_list_non_eval() reintroduced the sink that CVE-2026-84984 had fixed, so environments that patched the earlier CVE may wrongly assume they are safe. The main mitigating factor is PR:L: an attacker must first hold a valid panel account with a web domain, limiting exposure to multi-tenant/shared-hosting deployments and insiders rather than fully anonymous internet attackers.

A customer on a shared Hestia hosting server (a legitimate low-privileged panel user with a web domain) sets a custom document-root value containing a single quote, breaking out of the quoting in web.conf to inject an attacker-controlled PATH field. They place a malicious executable named 'column' in that path, then click the panel's ordinary Search feature; the root-privileged v-search-user-object script parses the forged field, overrides PATH, and invokes 'column' without an absolute path, running the attacker's binary as root. No weaponized public exploit is confirmed in the provided data, but the vendor advisory and a third-party write-up document the full technique and the fixing commit is public.