PT-2026-41897 · Hestiacp · Hestiacp

Divinity76 + 1 · Published 2026-05-19 · Updated 2026-05-26 · CVE-2026-43633

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HestiaCP versions 1.9.0 through 1.9.4

Description A deserialization issue exists in the web terminal component due to a session format mismatch between PHP and Node.js. This allows unauthenticated remote attackers to achieve root-level code execution by injecting crafted data into HTTP headers. These headers are processed by the PHP session handler and incorrectly deserialized by the Node.js web terminal component as trusted session values, leading to arbitrary command execution on systems where the web terminal feature is enabled.

Recommendations Update HestiaCP versions 1.9.0 through 1.9.4 to a patched version. As a temporary workaround, disable the web terminal feature to minimize the risk of exploitation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-43633

Affected Products

Hestiacp

References · 10

• 🔥 https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634 · Exploit
• https://github.com/hestiacp/hestiacp/commit/854d71b3c1737b0a0d0cc55c926008ffe1f6719b · Patch
• https://github.com/hestiacp/hestiacp/pull/5244 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43633 · Security Note
• https://github.com/hestiacp/hestiacp/issues/5229 · Note
• https://vulncheck.com/advisories/hestiacp-deserialization-rce-via-web-terminal · Note
• https://twitter.com/CVEnew/status/2056870225648161203 · Twitter Post
• https://twitter.com/ThreatAft/status/2059232904354705660 · Twitter Post
• https://twitter.com/OrizonCyber/status/2056766871370633411 · Twitter Post
• https://reddit.com/r/Wordpress/comments/1tlo80b/if_youre_running_the_web_terminal_plugin_on · Reddit Post