HestiaCP 1.10.2 has arrived as a service release, dropping just 17 hours after the massive 1.10.0 major update to address three immediate regressions. The hotfix patches two session-isolation vulnerabilities in the bundled file manager that could allow cross-user access to batch downloads and chunked uploads. It also corrects the Bind DNS SOA EXPIRE value to 1,209,600 seconds for better compliance and fixes a regression where sourcing /etc/os-release could overwrite the internal version variable during upgrades. Users on the 1.10.x branch can apply the changes now via the standard upgrade path.

HestiaCP 1.10.2 hits the wire with file manager security patches and DNS fixes

Released hours after the massive 1.10.0 update, the new version addresses session-isolation bugs in the file manager and a regression in the upgrade script.

HestiaCP has released 1.10.2. The timing is the real story here. This service release dropped less than 17 hours after the 1.10.0 major update went live.

The 1.10.0 release was a monster. It brought PHP 8.5 support, Debian 13 and Ubuntu 26.04 LTS compatibility, an upgrade to Roundcube 1.7, and a dozen new quick-install apps. There were also over 20 security hardening PRs, ranging from XSS prevention to fixes for authenticated admin takeover vulnerabilities. Given the scope, regressions were inevitable. Three of them showed up quickly.

Security fixes in the file manager

The headline item is the file manager update. The bundled FileGator-based manager has been bumped to version 7.15.1.

This isn't just a version number bump. It patches two session-isolation bugs reported by external researcher Yulio Valdes. Both affect multi-user deployments.

Previously, batch download archives weren't bound to the session that created them. If you had multiple users on a server, one could potentially access archives from another user's download queue. Chunked uploads also had an isolation issue. Crafted chunk filenames could reach another user's temporary upload files.

Now those are sandboxed per session. The update also includes UX tweaks. Dark theme readability in .box elements got a fix, Danish translation was added, and folder search navigation improved.

DNS SOA EXPIRE corrected

Next is a DNS compliance tweak. The SOA EXPIRE field in the Bind configuration was set to 3,600,000 seconds. That works out to roughly 41.7 days.

The value is non-standard and gets flagged by tools like intodns.com. The fix moves it to 1,209,600 seconds. That's exactly 14 days and aligns with common industry practice.

An incorrect SOA EXPIRE can cause secondary DNS servers to stop serving zones prematurely. That's bad for email deliverability and general availability.

The upgrade script quirk

Then there's the upgrade script bug. It's a classic shell scripting gotcha.

The installer sources /etc/os-release. That file contains a VERSION="..." line. When you source that as shell variables, the OS release string overwrites HestiaCP's internal version variable.

If you were upgrading from 1.10.0, your internal version string could end up as "22.04 LTS" instead of "1.10.2." Future upgrades that rely on version comparison logic might skip steps or malfunction. The fix ensures the internal version doesn't get clobbered by the OS string.

Here here for the release announcement.