CVE-2021-47871
Hestia Control Panel 1.3.2 - Arbitrary File Write
- State
- Published
- Severity
- 8.6 High
- Published
- Jan 21, 2026
- Updated
- Mar 5, 2026
- Reserved
- Jan 18, 2026
Description
Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
Hestia Control PanelHestia Control Panel |
|
References
- ExploitDB-49667exploit
- Hestia Control Panel Official Homepageproduct
- Hestia Control Panel GitHub Repositoryproduct
- VulnCheck Advisory: Hestia Control Panel 1.3.2 - Arbitrary File Writethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.