HestiaCP Web Terminal RCE: Critical Deserialization Vulnerability

The National Vulnerability Database has disclosed CVE-2026-43633, a critical deserialization vulnerability impacting HestiaCP versions 1.9.0 through 1.9.4. This flaw, rated 10.0 CVSS, resides in the web terminal component and allows unauthenticated remote attackers to achieve root-level code execution.

The vulnerability stems from a session format mismatch between PHP and Node.js components. Attackers can inject crafted data into HTTP headers. This data is processed by the PHP session handler but then incorrectly deserialized by the Node.js web terminal as trusted session values, leading directly to arbitrary command execution on systems where the web terminal feature is enabled.

This is a full-chain RCE from an unauthenticated, remote attacker. The implications are severe: complete system compromise without any prior access. Defenders must recognize that enabling a web terminal, while convenient, significantly expands the attack surface if not meticulously secured. This isn’t just a bug; it’s a fundamental design flaw in session handling across different environments, and it’s exactly the kind of cross-component interaction that attackers constantly probe.