PT-2026-3823 · Unknown · Hestia Control Panel

Numan Türle · Published 2026-01-21 · Updated 2026-01-21 · CVE-2021-47871

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hestia Control Panel version 1.3.2

Description An authenticated attacker can write files to arbitrary locations on the server. This is possible through the index.php API endpoint by exploiting the v-make-tmp-file command. Attackers can write content, such as SSH keys, to specific file paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2021-47871

Affected Products

Hestia Control Panel

References · 7

• 🔥 https://exploit-db.com/exploits/49667 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47871 · Security Note
• https://github.com/hestiacp/hestiacp · Note
• https://vulncheck.com/advisories/hestia-control-panel-arbitrary-file-write · Note
• https://t.me/CVEtracker/42662 · Telegram Post
• https://hestiacp.com · Note