The flaw arises in Hestia Control Panel when the update_object_value() function fails to escape single quotes while writing a custom document-root value into a user’s web.conf file. This vulnerability maps to CWE-427, CWE-88, and CWE-94, indicating path hijacking, PATH injection, and code generation control weaknesses. An authenticated low‑privileged user who owns a web domain can inject an extra PATH field. When that user later invokes the Search feature, the root‑privileged v‑search‑user‑object script loads the forged field through parse_object_kv_list_non_eval(), which allows shell‑variable names and globally replaces PATH before running the column command without an absolute path. By placing a malicious executable in the injected search path, the attacker can run arbitrary code with root privileges, compromising the entire system.

Hestia Control Panel (hestiacp) versions 1.9.7 through 1.10.4 are affected. The vulnerability was fixed in version 1.10.5; later releases are not vulnerable.

The CVSS score of 9.9 classifies this as Critical. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must be an authenticated low‑privileged user with a web domain; no remote network component is required. The flaw permits full privilege escalation via the Search feature, making exploitation straightforward for an authorized user.