Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-43633

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.

Ver en NVD

Análisis

A critical unauthenticated RCE vulnerability has been identified in HestiaCP versions 1.9.0 through 1.9.4. Attackers can achieve root access by exploiting a session deserialization mismatch between PHP and Node.js via crafted HTTP headers. Systems with the web terminal feature enabled should be updated immediately.

Roles relevantes

PhpLinuxCyberSecurityBackendJavascript

Severidad

Puntaje: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: HIGH
I: HIGH
A: HIGH
Tipo de falla (CWE): CWE-502

EPSS

Probabilidad de explotación (próx. 30 días): 0.0020 (0.2%)
Percentil: 42.1%
EPSS: 2026-05-25

Descripción técnica

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.

Publicada: 19/5/2026, 14:16:43
Última modificación: 19/5/2026, 14:43:04

Referencias

InicioEventosBlogRecursosEquipo