Skip to content

HestiaCP

v1.9.7 Security

This release includes 9 security fixes for security teams reviewing exposed deployments.

Published 9d Server & OS Management
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 9 known CVEs

Topics

apache2 control-panel control-panels dns dovecot exim
+6 more
linux-server mail-server nginx php web-panel web-server

Affected surfaces

auth rbac rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 9d

The 1.9.7 release of HestiaCP patches multiple critical security flaws including unauthenticated remote code execution, IP spoofing, XSS, command injection and SQL injection.

Why it matters: All listed vulnerabilities have severity 100 or higher (CVSS‑equivalent) affecting core components; immediate patching to version 1.9.7 is required for any deployment using Web Terminal, queue system, config parsing, auth flow, or database password handling.

Summary

AI summary

Broad release touches Bug fixes, https://github.com/hestiacp/hestiacp/security/advisories/GHSA-gh6f-9gpr-x9m2, https://github.com/hestiacp/hestiacp/security/advisories/GHSA-73p3-rqpv-59wx, and https://github.com/hestiacp/hestiacp/security/advisories/GHSA-fg7j-gpvw-2m73.

Changes in this release

Security Critical

Fixes Unauthenticated Remote Code Execution via Session Deserialisation Mismatch in Web Terminal

Fixes Unauthenticated Remote Code Execution via Session Deserialisation Mismatch in Web Terminal

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes IP Address Spoofing via `CF-Connecting-IP` Header

Fixes IP Address Spoofing via `CF-Connecting-IP` Header

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes Cross-site Scripting (XSS) in Hestia Control Panel

Fixes Cross-site Scripting (XSS) in Hestia Control Panel

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes Client to Root RCE via Newline Injection in v-add-cron-job and Eval Stdout Poisoning in parse_object_kv_list

Fixes Client to Root RCE via Newline Injection in v-add-cron-job and Eval Stdout Poisoning in parse_object_kv_list

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes Systematic Second‑Order Command Injection in Queue System Leading to Root RCE

Fixes Systematic Second‑Order Command Injection in Queue System Leading to Root RCE

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes Root RCE via double eval() on user‑controlled config data in parse_object_kv_list() (func/main.sh)

Fixes Root RCE via double eval() on user‑controlled config data in parse_object_kv_list() (func/main.sh)

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes Low‑privilege to root command execution via unescaped web.conf path fields evaluated by v-search-user-object

Fixes Low‑privilege to root command execution via unescaped web.conf path fields evaluated by v-search-user-object

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes SQL Injection in Database Password handling (CWE-89)

Fixes SQL Injection in Database Password handling (CWE-89)

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security Critical

Fixes Authenticated Admin Takeover vulnerability in HestiaCP <= 1.9.6

Fixes Authenticated Admin Takeover vulnerability in HestiaCP <= 1.9.6

Source: llm_adapter@2026-07-17

Confidence: high

 —
Security High

Removes eval from search utilities to improve security

Removes eval from search utilities to improve security

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Feature Medium

Adds ability to edit JSON files directly in the File Manager

Adds ability to edit JSON files directly in the File Manager

Source: llm_adapter@2026-07-17

Confidence: high

 —
Dependency Low

Bumps file manager to version 7.14.4

Bumps file manager to version 7.14.4

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Dependency Low

Bumps Roundcube to version 1.6.17

Bumps Roundcube to version 1.6.17

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Medium

Adds validation for backup fields in v-schedule-user-restore

Adds validation for backup fields in v-schedule-user-restore

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Medium

Secures database user creation and password change to prevent SQL injection

Secures database user creation and password change to prevent SQL injection

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Medium

Allows installation to continue when netplan config is missing

Allows installation to continue when netplan config is missing

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Medium

Checks SFTP jail status before add/delete user jail operations

Checks SFTP jail status before add/delete user jail operations

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Medium

Propagates private key detection to sftpc() function

Propagates private key detection to sftpc() function

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Low

Fixes typo in $KEEP_MONTHLY on v-backup-user-restic

Fixes typo in $KEEP_MONTHLY on v-backup-user-restic

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Low

Ensures HESTIA variable is sourced from hestia.conf

Ensures HESTIA variable is sourced from hestia.conf

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Low

Corrects incorrect comment in web/add/mail/index.php

Corrects incorrect comment in web/add/mail/index.php

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Low

Makes v-extract-fs-archive fully non‑interactive during extraction

Makes v-extract-fs-archive fully non‑interactive during extraction

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Bugfix Low

Fixes if statement in installer

Fixes if statement in installer

Source: granite4.1:30b@2026-07-17-audit

Confidence: low

 —
Full changelog

Version name changes

Due to the implementation for building ARM64 packages on X86-64 hardware the versions of hestia-nginx / hestia-php has been changed the format used for 1.10 and forward.

  • hestia-nginx-x.y.z-revision-os+release_architecture.deb
  • hestia-php-x.y.z-revision-os+release_architecture.deb

It has no effect on the working. Both "hestia" package and "hestia-web-terminal" will follow in the future.

Security

  • Unauthenticated Remote Code Execution via Session Deserialisation Mismatch in Web Terminal (GHSA-gh6f-9gpr-x9m2)
  • IP Address Spoofing via CF-Connecting-IP Header (GHSA-73p3-rqpv-59wx)
  • Cross-site Scripting (XSS) in Hestia Control Panel (GHSA-fg7j-gpvw-2m73)
  • Client to Root RCE via Newline Injection in v-add-cron-job and Eval Stdout Poisoning in parse_object_kv_list (GHSA-5fpv-c8rg-x6r3)
  • Systematic Second-Order Command Injection in Queue System Leading to Root RCE (GHSA-47mf-74xr-f8x9)
  • Root RCE via double eval() on user-controlled config data in parse_object_kv_list() (func/main.sh) (GHSA-w3mx-xq85-8qqc)
  • Low-privilege to root command execution via unescaped web.conf path fields evaluated by v-search-user-object (GHSA-cr7q-frhq-xw4v)
  • HestiaCP 1.9.6 — SQL Injection in Database Password (CWE-89) (GHSA-8w7m-g9c2-9q9p)
  • HestiaCP <= 1.9.6 Authenticated Admin Takeover (GHSA-fcq6-p8cj-xx3c)

Features

  • Add: JSON files can now be edited directly in the File Manager (#5342)

Bug fixes

  • Fix: Add validation for backup fields in v-schedule-user-restore (#5510)
  • Improve security by removing eval from search utilities (#5509)
  • Bump file manager to version 7.14.4 (#5508)
  • Secure database user creation / password change to prevent SQL injection (#5511)
  • Fix typo in $KEEP_MONTHLY on v-backup-user-restic (#5409)
  • Allow installation to continue when netplan config is missing (#5406)
  • Fix missing HESTIA variable by sourcing hestia.conf (#5433)
  • Check SFTP jail status before add/delete user jail operations (#5420)
  • Fix incorrect comment in web/add/mail/index.php (#5428)
  • Fix private key detection not being propagated to sftpc() (#5426)
  • Make v-extract-fs-archive fully non-interactive during extraction (#5436)
  • Fix if statement in installer (#5440)
  • Docs: Add mail cleanup guidance (#5371)
  • Bump Roundcube to version 1.6.17 (#5492)

Breaking Changes

  • Package version format changed for hestia-nginx and hestia-php to include architecture (e.g., hestia-nginx-x.y.z-revision-os+release_architecture.deb).

Security Fixes

  • GHSA-gh6f-9gpr-x9m2 – Unauthenticated Remote Code Execution via Session Deserialisation Mismatch in Web Terminal
  • GHSA-73p3-rqpv-59wx – IP Address Spoofing via `CF-Connecting-IP` Header
  • GHSA-fg7j-gpvw-2m73 – Cross-site Scripting (XSS) in Hestia Control Panel
  • GHSA-5fpv-c8rg-x6r3 – Client to Root RCE via Newline Injection in v-add-cron-job and Eval Stdout Poisoning in parse_object_kv_list
  • GHSA-47mf-74xr-f8x9 – Systematic Second-Order Command Injection in Queue System Leading to Root RCE
  • GHSA-w3mx-xq85-8qqc – Root RCE via double eval() on user‑controlled config data in parse_object_kv_list() (func/main.sh)
  • GHSA-cr7q-frhq-xw4v – Low‑privilege to root command execution via unescaped web.conf path fields evaluated by v-search-user-object
  • GHSA-8w7m-g9c2-9q9p – SQL Injection in Database Password (CWE-89) for HestiaCP 1.9.6
  • GHSA-fcq6-p8cj-xx3c – Authenticated Admin Takeover for HestiaCP <= 1.9.6
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track HestiaCP

Get notified when new releases ship.

Sign up free

About HestiaCP

Hestia Control Panel | A lightweight and powerful control panel for the modern web.

All releases →

Related context

Beta — feedback welcome: [email protected]