PT-2026-3823 · Unknown · Hestia Control Panel

Numan Türle · Publicado 2026-01-21 · Atualizado 2026-01-21 · CVE-2021-47871

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hestia Control Panel version 1.3.2

Description An authenticated attacker can write files to arbitrary locations on the server. This is possible through the index.php API endpoint by exploiting the v-make-tmp-file command. Attackers can write content, such as SSH keys, to specific file paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

CVE-2021-47871

Produtos afetados

Hestia Control Panel

Referências · 7

• 🔥 https://exploit-db.com/exploits/49667 · Exploit
• https://github.com/hestiacp/hestiacp · Nota
• https://vulncheck.com/advisories/hestia-control-panel-arbitrary-file-write · Nota
• https://osv.dev/vulnerability/CVE-2021-47871 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-47871 · Nota de Segurança
• https://t.me/CVEtracker/42662 · Publicação no Telegram
• https://hestiacp.com · Nota