An arbitrary file write vulnerability in Hestia Control Panel 1.3.2 allows authenticated attackers to execute unauthorized file operations, posing a severe risk of system compromise.

The application is susceptible to an arbitrary file write vulnerability via the API index.php endpoint. By leveraging the v-make-tmp-file command, an authenticated attacker can write files to sensitive locations, such as adding unauthorized SSH keys to the server.

Successful exploitation of this vulnerability allows an authenticated attacker to gain full control over the affected server. By writing arbitrary content to critical file paths, such as SSH authorized_keys, an attacker can establish persistent backdoor access, resulting in complete system compromise and potential data exfiltration. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized administrative access.

Immediate Action: Upgrade Hestia Control Panel to version 1.3.3 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review system logs for suspicious API requests to index.php, particularly those invoking the v-make-tmp-file command with unusual file paths.

Compensating Controls: Restrict access to the API endpoint to trusted IP addresses using a Web Application Firewall or network-level access control lists to limit the exposure of the management interface.

Public Exploit Available: Yes, a public exploit exists as documented in the Exploit Database (EDB-ID: 49667).

This vulnerability presents a significant risk to the integrity and confidentiality of the Hestia Control Panel environment. Administrators should prioritize updating the software to version 1.3.3 or higher to close the file write vector. Failure to patch may allow attackers to escalate privileges or establish persistence, leading to a complete system takeover.