CVE-2021-3797: Hestiacp control panel vulnerability

Hestiacp · Control Panel

hestiacp is vulnerable to Use of Wrong Operator in String Comparison

9.8 CVSS 3.1 Critical EPSS 1.1% · top 34.5% CWE-597 · CWE-597

9.8CVSS 3.1 base score, v2 7.5

1.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

hestiacp is vulnerable to Use of Wrong Operator in String Comparison

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Control Panel Hestiacp

References

Link	Tags
https://github.com/hestiacp/hestiacp/commit/fc68baff4f94b59e38316f886d0ce47d337042f7	PatchThird Party Advisory
https://huntr.dev/bounties/c24fb15c-3c84-45c8-af04-a660f8da388f	ExploitIssue TrackingPatchThird Party Advisory
https://github.com/hestiacp/hestiacp/commit/fc68baff4f94b59e38316f886d0ce47d337042f7	PatchThird Party Advisory
https://huntr.dev/bounties/c24fb15c-3c84-45c8-af04-a660f8da388f	ExploitIssue TrackingPatchThird Party Advisory

Track CVE-2021-3797 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-2636Hestiacp control panel code injection vulnerabilityImproper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.EPSS 1.3%5 Aug 2022 8.8CVE-2022-2550HestiaCP control panel OS command injectionHestiaCP versions prior to 1.6.5 contain an OS command injection flaw (CWE-78) in the control panel. A remote attacker with low-privileged credential…EPSS 48%analysed27 Jul 2022 8.8CVE-2022-1509Hestiacp control panel command injection vulnerabilityCommand Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can exec…EPSS 4.5%28 Apr 2022 8.7CVE-2025-30007Hestiacp control panel os command injection vulnerabilityHestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary…EPSS 3.2%10 Jul 2026 7.8CVE-2023-5839Hestiacp control panel vulnerabilityPrivilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.EPSS 0.29%29 Oct 2023 7.2CVE-2022-2626Hestiacp control panel vulnerabilityIncorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.EPSS 1.2%5 Aug 2022 6.5CVE-2020-10966Hestiacp control panel vulnerabilityIn the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account…EPSS 1.9%25 Mar 2020 6.1CVE-2023-3479Hestiacp control panel cross-site scripting vulnerabilityCross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.EPSS 1.3%30 Jun 2023

Source: NIST National Vulnerability Database (record CVE-2021-3797), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.