TI-2026-31737 Aliases CVE-2026-43633 GHSA-p57r-8pg4-2892

HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

HIGH 82CWE-502Published 2026-05-19 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01072 65th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hestiacp	hestiacp	1.9.0 – 1.9.4	—	Patch available	CNA

hestiacp Vendorhestiacp Affected 1.9.0 – 1.9.4 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-43633
2026-10-03 Alias added: GHSA-p57r-8pg4-2892

References

Exploit 1

https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634

Patch 2

Other 1

https://github.com/hestiacp/hestiacp/issues/5229

TI-2026-31738 HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header CVSS 4.0HIGH 8.7
TI-2026-74366 PATH hijacking in HestiaCP lets low-privileged users run code as root CVSS 3.1CRITICAL 9.9
TI-2026-75413 HestiaCP Protected Admin Bypass via Cron Job Creation CVSS 4.0HIGH 8.6
TI-2026-10488 HestiaCP Admin Takeover CVSS 4.0HIGH 8.3
TI-2023-05375 Privilege Chaining in hestiacp/hestiacp CVSS 3.1HIGH 7.8
TI-2022-02355 OS Command Injection in hestiacp/hestiacp CVSS 3.1HIGH 8.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences