CVE-2021-27231: Hestiacp Control Panel

Medium severity, CVSS 5.4. EPSS: 1.4% chance of exploitation in the next 30 days.

Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages.

Affected products

• Hestiacp Control Panel: up to and including 1.3.5

Published 2021-02-16. Last modified 2026-06-17.