Deserialization in Hestiacp
CVE-2026-43633
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.015 · change: +0.004
Affected products
- Hestiacp — versions 1.9.0, 854d71b3c1737b0a0d0cc55c926008ffe1f6719b
Weakness classification (CWE)
References
- mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2… (issue-tracking, technical-description, exploit)
- github.com/hestiacp/hestiacp/issues/5229 (issue-tracking)
- github.com/hestiacp/hestiacp/pull/5244 (issue-tracking, patch)
- github.com/hestiacp/hestiacp/commit/854d71b3c1737b0a0d0cc55c926008ffe1f6719b (patch)
- www.vulncheck.com/advisories/hestiacp-deserialization-rce-via-web-terminal (third-party-advisory)
Frequently asked questions
- What is CVE-2026-43633?
- CVE-2026-43633 is a critical-severity vulnerability in Hestiacp, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2026-05-19.
- How severe is CVE-2026-43633?
- Critical severity. CVSS v3 base score is 10.0 out of 10.