CVE-2026-43633: HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43633?
CVE-2026-43633 is classified as a remote code execution vulnerability that allows unauthenticated attackers to gain root access.
How do I fix CVE-2026-43633?
To remediate CVE-2026-43633, upgrade HestiaCP to version 1.9.5 or later which addresses the deserialization issue.
What versions of HestiaCP are affected by CVE-2026-43633?
HestiaCP versions 1.9.0 to 1.9.4 are affected by CVE-2026-43633.
Can CVE-2026-43633 be exploited remotely?
Yes, CVE-2026-43633 can be exploited by unauthenticated remote attackers through the web terminal component.
What type of attacks does CVE-2026-43633 facilitate?
CVE-2026-43633 facilitates remote code execution attacks due to deserialization vulnerabilities.