hestiacp vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20228
3. 20234
4. 20267

Newest CVEs

• CVE-2026-111627

  HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation

  hestiacp · hestiacp

  High8.6
• CVE-2026-108390

  HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

  hestiacp · hestiacp

  Critical9.9
• CVE-2025-30008

  HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface

  hestiacp · hestiacp

  Medium5.1
• CVE-2025-30007

  HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

  hestiacp · hestiacp

  High8.7
• CVE-2026-12196

  HestiaCP Admin Takeover

  hestiacp · hestiacp

  High8.3
• CVE-2026-43634

  HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

  hestiacp · hestiacp

  High8.7
• CVE-2026-43633

  HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

  hestiacp · hestiacp

  Critical9.5
• CVE-2023-5839

  Privilege Chaining in hestiacp/hestiacp

  hestiacp · hestiacp/hestiacp

  High8.8
• CVE-2023-4517

  Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp

  hestiacp · hestiacp/hestiacp

  Low3.2
• CVE-2023-5084

  Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

  hestiacp · hestiacp/hestiacp

  Low3.9