HestiaCP 1.9.8 Arrives with Security Hardening Two Weeks After Massive CVE Sweep
The latest control panel update addresses privilege escalation risks, notification XSS, and a regression in the SFTP jail feature.
Two weeks after releasing 1.9.7, an update that cleaned up nine critical CVEs including RCE and SQL injection, HestiaCP dropped version 1.9.8 on July 30, 2026. This is the second security-focused release in under a month.
If you're running HestiaCP right now, you should probably apply it. The 1.9.7 haul was broad, but 1.9.8 is about closing the edge cases that survived the initial sweep.
The release cadence here signals an active security response pattern. The team isn't waiting for the next feature cycle to fix what they found.
The Security Fixes
The headline fix addresses the ROOT_USER account modification restriction (GHSA-c69h-jgpw-h9cj). This is directly related to the "rename admin user" feature introduced back in 1.9.0.
Previously, any authenticated user with access to certain admin functions could modify the ROOT_USER settings, even while impersonating another session. The fix ensures only the actual ROOT_USER session can change those settings. Additionally, hardcoded references to "admin" were replaced with the configurable ROOT_USER variable throughout role validation logic.
Next, there's an XSS fix in the notification system (GHSA-3g4r-pfpf-8697). The v-add-user-notification command accepted unvalidated input that could be reflected back to users. That's a classic stored XSS vector. The patch adds validation to prevent injection through this code path.
The debug panel had similar issues. It was displaying raw $_SERVER, $_SESSION, $_POST, and $_GET values via var_dump(). Someone with access to the debug panel could now see sensitive session or cookie data if they knew where to look. The fix uses tohtml() for proper escaping on all string variables and switches arrays to var_export() with tohtml() wrapping.
Backup queue file injection (GHSA-2xw3-7h62-v4gf) was also patched. In v-schedule-user-restore-restic, the $value variable was written directly into a backup queue file without validation. Crafted filenames or path traversal via the value parameter could allow command injection. The fix validates the value against is_format_valid() before queuing.
The Bug Fixes
Four functional bugs made it into 1.9.8 as well.
The SFTP jail regression is the most notable. HestiaCP's Jailed SSH, which uses bubblewrap sandboxing, had a bug where v-add-sys-sftp-jail incorrectly appended -server to the Subsystem directive when SSH jail was already active. This broke SFTP access for jailed users. It's a classic case of a security feature introducing operational risk. An upgrade script at install/upgrade/manual/1.9.8.sh handles the migration.
FTP certificate reloading was broken too. v-restart-ftp issued a reload instead of a full stop/start, so new TLS certificates weren't picked up. Users changing FTP SSL certs would see certificate errors until they restarted manually. That's fixed in PR #5005.
There's also a fix for invalid JSON in the SSL listing (PR #5524). OpenSSL certificate issuers like O = "CloudFlare, Inc." contain literal quotes that broke JSON parsing by jq. The fix applies the same escaping used in v-list-web-domain-ssl.
Hidden database services were being listed even when not installed, which was confusing in the admin UI. Now the panel checks for actual binary presence before listing services.
phpMyAdmin and phppgadmin had broken SCRIPT_FILENAME paths due to Nginx FastCGI regex alias interaction. This caused "No input file specified" errors when cgi.fix_pathinfo = 0.
Restic restore path lookup had a concatenation error ($REPO$user without separator), making snapshot existence checks fail. Incremental user restores would throw "Unable to download from snapshot" as a result.
Community Response
The GitHub release has four reactions so far. Compare that to the eight reactions on 1.9.7. The community awareness is still growing for this patch.
That's not unusual for a security hardening release. Most HestiaCP users apply patches via v-update-hestia and move on. The 1.9.x series has seen 10 releases over the last six months, suggesting a highly active development cycle.
If you need to upgrade, run v-update-hestia. The SFTP jail fix requires the manual migration script at install/upgrade/manual/1.9.8.sh.
Head here to the full release notes and PRs.
