Vulnerability details
CVE-2021-47871
Hestia Control Panel Hestia Control Panel
Hestia Control Panel 1.3.2 - Arbitrary File Write
CVSS 4.0
8.6High
Official description
Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the server.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 8.8High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Hestia Control Panel | Hestia Control Panel | 1.3.3 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://www.exploit-db.com/exploits/49667 exploit
- https://hestiacp.com/ product
- https://github.com/hestiacp/hestiacp product
- https://www.vulncheck.com/advisories/hestia-control-panel-arbitrary-file-write third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-21
- Last updated
- 2026-03-05
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.5%
Probability of exploitation in 30 days
43%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-73External Control of File Name or Path