🔐 CVE Alert

CVE-2021-47871

HIGH 8.8

Hestia Control Panel 1.3.2 - Arbitrary File Write

CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th

Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the server.

CWE CWE-73
Vendor hestia control panel
Product hestia control panel
Published Jan 21, 2026
Last Updated Mar 5, 2026
Stay Ahead of the Next One

Get instant alerts for hestia control panel hestia control panel

Be the first to know when new high vulnerabilities affecting hestia control panel hestia control panel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

Hestia Control Panel / Hestia Control Panel
1.3.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
exploit-db.com: https://www.exploit-db.com/exploits/49667 hestiacp.com: https://hestiacp.com/ github.com: https://github.com/hestiacp/hestiacp vulncheck.com: https://www.vulncheck.com/advisories/hestia-control-panel-arbitrary-file-write

Credits

Numan Türle