[1.10.6] - Service Release

Security

• Harden restore scripts: refuse symlinked user directories, stage restores in a root-owned directory, quote variables and use chown --no-dereference #5796
• Fix path traversal in the File Manager escapeDots filter (File Manager 7.16.4) #5732
• Fix Hestia root user authentication check in the File Manager #5739
• Add read-only/demo mode check for POST request handling #5756
• Improve checks for special characters in custom document roots and escape them before template replacement #5759
• Fix mkpasswd argument parsing so passwords or salts starting with - are not treated as options #5764
• Escape array keys in the debug panel #5750
• Fix Header Location redirects #5737
• Fix and harden Exim HELO checks: require HELO for all clients, reject bare/IP-like HELOs and our own IP, log FCrDNS and HELO/PTR mismatches #5862
• Quote domain config path in is_dns_domain_new and is_mail_domain_new #5853
• Fix public_html directory permissions when adding a web domain and use null-delimited paths in find #5730
• Ensure user tmp directory ownership and permissions during rebuild_user_conf #5849

Changes

• Add ECDSA key algorithm support for Let's Encrypt certificates #5629
• Add support for a custom DKIM selector #5760
• Add v-delete-user-wp-cli and let v-add-user-wp-cli manage .bash_aliases without duplicate entries #5786 #5787 #5788
• Add E_BACKUP error code for backup operations #5785
• Use the Sury repository for PHP on all Ubuntu versions instead of the PPA, existing installs are migrated #5825
• Let unattended-upgrades patch hosted PHP, nginx, Node.js, MariaDB, PostgreSQL and Apache (Ondřej Surý PPA) packages #5876 #5877 #5878 #5879 #5880 #5881 #5882
• Use the crontab command to install user cron jobs #5805
• Optimize JSON listing with bulk validated object parsing #5726 #5890
• Support bond interfaces in hestia-nginx port detection #5752
• Autofocus the web terminal on page load #5893
• Remove the admin account warning from the add web, mail, database and DNS pages, as the admin account no longer has sudo privileges #5896
• Set default LANG to C.UTF-8 for web terminal sessions #5770
• Increase length of the Record column in the DNS records list #5771
• Remove txt from default PROXY_EXT to avoid expires max on robots.txt #5850
• Skip release branch version check when installing alpha/beta packages #5851
• Add rsync dependency and pre-check for Roundcube upgrades #5824
• Improve build speed and pass --pkgrev through in hst_autocompile #5891
• Bump hestia-php to 8.5.12 #5738 #5816
• Bump hestia-nginx to 1.30.6 #5723 #5797
• Bump OpenSSL to 3.5.9 and PCRE to 10.49 #5751
• Bump File Manager to 7.16.9 #5717 #5732 #5741 #5827 #5898
• Bump Quick Install app versions: Castopod, Grav, Joomla, MediaWiki, PrestaShop #5899
• Update Roundcube to 1.7.5 #5810
• Update SnappyMail to 3.0.0 #5901
• Run BATS suite on nginx-only installs and add upgrade migration tests #5865 #5861
• Update dependencies #5734 #5735 #5765 #5766 #5789 #5790 #5791 #5807 #5832 #5838 #5840 #5847 #5884 #5894 #5895

Fixes

• Fix IDN handling in Let's Encrypt SSL certificate generation #5814
• Fix mail certificate renewal check so expired SMTP/IMAP certificates are renewed #5829
• Fix missing newline before SAN section in OpenSSL config #5831
• Set root:mail ownership on Hestia host certificates to avoid AppArmor conflict with ProFTPD #5778
• Fix ProFTPD not loading configuration files from conf.d #5859
• Fix typo in Dovecot SSL certificate configuration #5844
• Fix incremental restore mixing up database/mail/file restore types #5740
• Fix bug with the B2 CLI tool #5728
• Fix tar path handling #5754
• Fix syntax and error code typos in backup scripts #5782 #5783 #5784
• Fix suspend/unsuspend of DNS records on remote DNS hosts #5821 #5845 #5846
• Fix Bind default-zones include removal in Debian 13 / Ubuntu 26.04 migration scripts #5836
• Fix PHP version installation failure handling in v-add-web-php #5823
• Keep working PHP dependencies when v-add-sys-dependencies fails #5871
• Fix Composer 2.11 download failures with libcurl on Ubuntu 22.04 #5888
• Fix v-add-sys-roundcube for rsync 3.5.x #5811
• Fix v-add-sys-web-terminal installing the OS Node.js package instead of v24 #5763
• Fix v-change-web-domain-ftp-path path handling #5777
• Fix SSH key deletion and listing #5743
• Fix proxy extension validation #5768
• Fix trailing whitespace in domain IP in web.conf and is_ip_valid, trimmed on upgrade #5858 #5861
• Fix nginx 500 in phpMyAdmin/phpPgAdmin includes by using named captures #5863
• Fix phpMyAdmin config loop adding a phantom server for non-server conf.d files #5795
• Speed up cleanup_key_permissions for keys with long permission lists #5792
• Fix doubled user prefix in Quick Install database name and show CLI output on failure #5875
• Fix WordPress Quick Install failing for locales without a localized release zip by falling back to en_US and installing the language pack, and fix the zh_CN locale identifier #5900
• Fix trailing single quote being stripped when editing cron commands #5892
• Fix undefined $panel in policies.php #5835
• Fix File Manager showing the session-timeout redirect as file content #5636
• Fix installer race with apt-get upgrade and prevent --with-debs from overwriting local packages
• Fix mobile navbar colors and dropdown in dark mode #5775

[1.10.5] - Service Release

Security

• Verify user role/session has not been tampered with and fix suspended users not always having their login disabled #5706
• Fix v-unsuspend-user using the wrong POLICY_USER_VIEW_SUSPENDED comparison, so unsuspending a user did not always unlock their account #5711
• Improve read-only/demo mode enforcement, closing bypasses via direct URLs (e.g. /add/cron/), open redirects, and the admin login-as flow #5688
• Improve conf parsing and reserved-key handling to prevent injection via crafted config values #5698

Changes

• Remove support for Debian 11 (Bullseye) #5654
• Bump Quick Install app versions: Dolibarr, Drupal, Grav, Joomla, OpenCart, PrestaShop #5700
• Bump hestia-php to 8.5.10 #5678
• Bump OpenSSL to 3.5.8 #5658
• Update PCRE to 10.48 #5673
• Update Roundcube to 1.7.4 #5690
• Bump File Manager to 7.16.2 #5695
• Enhance backup detail pages by adding icons to item types #5679
• Update dependencies #5666 #5693 #5694
• Add missing tests for suspending users #5710

Fixes

• Fix inverted database limit check condition that could block users from creating databases within their quota #5640
• Fix phpMyAdmin SSO for remote databases and redirects to the wrong server #5454
• Rename phpMyAdmin tempdir configuration to load it last #5655
• Fix restic full restore to restore all objects and correct cron binary name #5709
• Fix backup host setup passing $raw_password instead of $password for Backblaze B2 credentials #5697
• Fix issues when running behind a NAT / reverse proxy setup #5689
• Implement locking mechanism for Fail2Ban actions and firewall state, and fix raw IP CIDR handling #5699
• Fix ProFTPd on Debian 13 and Ubuntu 26.04 #5677
• Omit CN for domains longer than 64 characters when generating SSL certificates #5676
• Fix Global SMTP relay password validation #5665
• Validate empty database alias #5663
• Fix Apache2 logrotate when webstats fails because the domain is suspended #5685
• Fix "Rejected because" DNSBL message for existing Exim installations #5683
• Fix action button icons overlapping text on mobile view #5680

[1.10.4] - Service Release

Security

• Hide accidental password leaking via auth.log / journalctl for sudo commands #5648
• Add owner verification to v-schedule-user-restore #5645

Changes

• Disable imap and smtp debug in Roundcube by default to prevent disk space issues #5642
• Add check_hestia_demo_mode to all v-list-*-ssl scripts #5639

Fixes

• Fix database temp user creation failing on MySQL HeatWave due to Medium Password Policy #5453
• Fix bug in SFTP backup rotation causing backup storage to not properly rotate #5646
• Fix back link and Access Keys button pointing to wrong user #5635 #5638
• Fix migration scripts not adding the imap_sieve plugin to the IMAP config #5637
• Fix typo in serial causing an inconsistent default DNS serial value #5632
• Improve File Manager installation validation and error logging #5634

Changes

• Update locales.

Fixes

• Adjust text wrapping behavior in u-text-break utility #5621
• Fix missing symfony/mime dependency in FileManager and reinstall on upgrade #5616
• Fix 1.10.3.sh script to reinstall FileManager #5622
• Reorder firewall rules after rule deleting preventing a bug with moving up / down causing duplicate lines #5623

Changes

• Bump file manager to version 7.15.1 #5608

Fixes

• Change SOA EXPIRE from 3600000 to 1209600 #5606
• Fix accidently overwrite VERSION during upgrade #5610

Fixes

• Set UPGRADE_REBUILD_USERS to true for mail templates rebuild

Security

• Add validation for v-add-user-notification to prevent xss injection #5548
• Added missing check to see if user can access DNS templates or is admin
• Added that local usernames can't be used in Hestia. (#5134)
• another urlencode+htmlecode fix (#5261)
• Block access to internal folders and sensitive files (#5446)
• chore(deps): update dependency symfony/process to v8.0.5 [security] (#5217)
• Cleanup argument handling and improve kv parsing (#5309)
• Fix an issue where a long text could by by pass 2FA check (#5203)
• fix: don't leak the panel port in the phpMyAdmin restrict redirect
• Fix: Sanitize user notification HTML and validate content
• Harden DNS record listing escaping (#5196)
• harden dns record validation (#5197)
• Harden HTML/URL encoding across templates and views (#5245–#5258)
• Improve cron command validation and sync loop logic (#5444)
• Improve logging of Spamhaus DQS lookups without exposing query key (#5011)
• Improve security by removing eval (#5509)
• Quotes variables for is_common_format_valid (#5218)
• refactor(snappymail): move config to /var/lib/snappymail and support hardened PHP-FPM (#5344)
• Restrict ROOT_USER account modifications to the ROOT_USER session (#5547)
• Secure SSL settings (#5109)
• Secure user creation / password change to prevent sql injection (#5511)
• Stop trusting unauthenticated proxy headers (#5273)
• Use ROOT_USER variable instead of hard‑coded admin in restic restore scripts (#5201)
• validate ip before assign (#5282)
• validate-backup-fields (#5510)

Features

• Add Debian/Ubuntu package versioning with PKG revision, release tags and distro suffix support #5423
• Add default checked state for DKIM checkbox (#5220)
• Add dynamic maxelem and hashsize to v-add-firewall-ipset (#5198)
• Add ESMTP to SMTP banner in Exim configuration templates (#5140)
• Add ext4 native quota support and improve filesystem quota handling (#5200)
• Add Fail2Ban unban support to firewall ban removal script (#5139)
• Add HTTP_HOST param, cleanup headers, and add WordPress HTTP/3 templates (#5185)
• Add KexAlgorithms during Debian 13 installation (#5457)
• Add OS-aware Hestia install version build
• Add PHP 8.5 support for Laravel Quick Install (#5463)
• Add posibility to build hestia package without any chroot (#5531)
• Add root-hints during Debian 13 install (#5460)
• Add Roundcube logrotate configuration and adjust file permissions (#5142)
• Add SAN support to v-generate-ssl-cert (#4937)
• Add script migrate_conf_to_debian_13.sh (#5419)
• Add support for more PHP versions based on official support documentation (#5287)
• Add support for Ubuntu 26.04 LTS (#5458)
• Add support to roundcube 1.7 (#5129)
• Add zsh support for Hestia PATH configuration (#5191)
• Add: Show user and bandwidth quota in the dashboard (#5031)
• added Contao configs (#5105)
• Adds cross-architecture and multi-OS package building #5499
• Allow overriding BUILD_DIR via environment in hst_autocompile.sh
• Bump hestia-php to version 8.5.9 (#5564)
• Configure Nginx to handle Livewire v3 asset requests (#5260)
• Count custom backend templates (e.g. *-PHP-x_y) in PHP version usage screen (#5228)
• feat(Firewall): Added the ability to order firewall rules, changing their precedence within the iptables (#5080)
• feat(installer): add osticket to quick install apps (#5471)
• feat(Installer): add shopware to quick install apps (#5529)
• feat(Installers): bump versions of apps #5518
• feat(mail): implement DNSBL management CLI for Exim (#5464)
• feat(webapp): add castopod to quick install apps (#5439)
• feat(webapp): add classicpress to quick install apps (#5355)
• feat(webapp): add concrete cms to quick install apps (#5459)
• feat(webapp): add qloapps to quick install apps (#5417)
• feat(webapp): update setups to install the latest version of apps (#5431)
• feat: add option to restrict phpMyAdmin to Hestia SSO only #5504
• feat: update public-suffix-list if older than 7 days (#5266)
• Implement LE Pre- and Post Hooks. (#4925)
• Improve Roundcube installation/upgrade process and bump to 1.7.3 (#5581, #5586, #5596)
• Make JSON editable in File Manager (#5342)
• PHP-8.5 support (#5157)
• Prepare Debian 13 support merge (#5388)
• run UTF-8 locale (#4704)
• Update default and required PHP versions for Debian installation (#5461)
• Update docs and CLI reference (#5597)
• Update Exim config for Dovecot 2.4 (#5579)
• Update locale files for Spanish, Estonian, Lao, and Ukrainian (#5598)
• Update user composer installations during Hestia upgrade (#5553)

Bug fixes

• Accept invalid hostname for CNAME records (#5291)
• Add -f flag to rm command in v-add-mail-domain-smtp-relay to avoid error if ip file does not exist (#5086)
• Add error meesage instead of fallback to chmod
• Allow continuing installation when netplan config is missing (#5406)
• Allow slash when adding username to smtp relay (Fixes #4973) (#4974)
• Avoid recreating existing webmail DNS records (#5567)
• Change NGINX template to 'dokuwiki' (#5445)
• Check SFTP jail status before add/delete user jail operations (#5420)
• Class change for latest version of file manager. (#4871)
• Comment out ssl_stapling directives due to Lets Encrypt ending OCSP support in 2025 (#5002)
• Ensure composer alias uses the user-defined PHP CLI (#5155)
• Ensure newline at end of hestiaweb user crontab (#4992)
• Fix "does not exist" (#4938)
• Fix 1.9.5: rebuilding mail domains removes webmail SSL config (#5354)
• Fix backup list conflict with usernames and dots #4918
• Fix bug HestiaZipArchiver.php #5411
• Fix bug in PR #4937 (#4995)
• Fix bug in v-add-sys-sftp-jail when ssh jail is active (#4873)
• Fix conflict with usernames and dots
• Fix domain alias replacement logic when changing web domain (Fixes #5015) (#5041)
• Fix dovecot conf path in installer and minor fixes (#5391)
• Fix editing Panel Cronjobs for hestiaweb (#4891)
• Fix File Manager HTTP 500 when session user is empty (#5318) (#5441)
• Fix File Manager ignoring user language (#5374)
• Fix FileGator 7.13.4 session migrate incompatibility in Hestia (#5241)
• Fix get correct home for numeric-only usernames when creating jail mount (#5126)
• Fix get_percentage() returning 0 when total limit is unlimited (#5395)
• Fix hestia logrotate (#5148)
• Fix hestia-php deb dependencies for Debian 13 (libzip5)
• Fix if statement (#5440)
• Fix incorrect comment in web/add/mail/index.php (#5428)
• Fix incorrect default for UPGRADE_UPDATE_* and UPGRADE_REBUILD_USERS (#5578)
• Fix invalid JSON output in v-list-mail-domain-ssl (#5524)
• Fix ipv4_cidr validation (#5044)
• Fix issue where settings are not accessible via web (#5565)
• Fix issue with webterminal (#5591)
• Fix issues with web-terminal on NodeJS 24 (#5560)
• Fix Json format (#5059)
• Fix Let's Encrypt YR1 chain validation (#5397)
• Fix letsencrypt user key mismatch #5294
• Fix logic error in IP list size check (#4941)
• Fix missing Arabic language (#5375)
• Fix missing dependency proftpd-mod-crypto on Ubuntu (#4895)
• Fix missing HESTIA variable by sourcing hestia.conf (#5433)
• Fix netplan permissions. (#5159)
• Fix nginx 403 error page (#5495)
• Fix PHP environment in Jailbash (chroot) #5434
• Fix PHP environment in Jailbash (chroot) for Laravel and Composer
• Fix php-fpm template to allow dynamically generated tracking code (#5212)
• Fix phpMyAdmin SSO hostname detection
• Fix port logging in v-add-firewall-rule (#5176)
• Fix PR #5162 (#5343)
• Fix PR #5254 (#5259)
• Fix regex in postinst
• Fix regression in upgrade_phppgadmin function (#5592)
• Fix SCRIPT_FILENAME in phpmyadmin/phppgadmin templates (#5535)
• Fix SpamAssassin service name for Ubuntu 24.04 (#5162)
• Fix SSL panel breaking on certs with commas in Subject/Issuer DN (#5585)
• Fix syshealth wrongly re-adding deleted config keys (#5584)
• Fix the way Hestia validates chain certificate (#4887)
• Fix upgrade_phppgadmin function (#5562)
• Fix v-add-user-composer update (#5552)
• fix user dir container with spaces in name #4917
• fix v-list-database-host: correct path to configuration file (#5114)
• Fix vstats link to use https when SSL enabled (#5183)
• Fix(#4979): Fixes domain redirects not being suspended (#4991)
• fix(biome): add aria-hidden and focusable="false" to decorative SVGs (#5407)
• fix(filemanager): avoid blocked sudo chmod and grant .ssh traversal for hestiaweb (#5242)
• fix(HestiaApp.php): increase timeout to handle long processes (#5432)
• Fix(i18n): add locale fallback when en_US.UTF-8 is unavailable (#5386)
• fix(installer): use single quotes to prevent password expansion (#5404)
• fix(letsencrypt): detect user.key/KID mismatch in v-add-letsencrypt-user
• fix(nginx): name the trusted header in the cloudflare.inc fallback (#5589)
• fix(services): Hide DB services if not installed #5455
• Fix: 421 error on all web and mail domains after Apache 2.4.64 update (#5058)
• fix: Avoid crash during Hestia install (#5223)
• Fix: avoid spamd execution in Exim when reject_spam is off (#5076)
• fix: build restic repo path as $REPO/$user in restic scripts (#5100)
• Fix: convert SRV record targets to IDN #5505
• fix: convert SRV record targets to IDN so umlaut DNS zones load (#4951)
• fix: enhance domain and alias format validation rules (#5128)
• fix: error adding self-signed cert using default options (#5483)
• Fix: handle missing session gracefully in SessionStorage (#5254)
• fix: keep IFS local in restic web restore so nginx conf is valid (#4986)
• fix: prefer the default route system IP for DNS cluster master
• Fix: Preserve SSL and redirect on cert renewal failure (#5149)
• fix: prevent deb packages from being moved to filesystem root
• fix: prevent empty user variable from affecting multiple scripts (Fixes #4926) (#4928)
• Fix: prev...

Full Changelog: 1.9.8...1.9.9

Security

• Restrict ROOT_USER account modifications to the ROOT_USER session (#5547) (GHSA-c69h-jgpw-h9cj)
• Fix: Sanitize debug panel variable output / Delete button SSH key (#5550)
• Add validation for v-add-user-notification to prevent XSS injection (#5548) (GHSA-3g4r-pfpf-8697)
• Validate value argument in v-schedule-user-restore-restic to prevent injection into backup queue file (GHSA-2xw3-7h62-v4gf)

Bug fixes

• Fix invalid JSON output in v-list-mail-domain-ssl (#5524)
• Fix: v-restart-ftp only reloads vsftpd; full restart needed to reload certs (#5005)
• Fix bug in v-add-sys-sftp-jail when ssh jail is active (#4873)
• Hide DB services if not installed (#5455)
• Fix SCRIPT_FILENAME in phpmyadmin/phppgadmin templates (#5535)
• Fix repo path lookup in v-schedule-user-restore-restic

Version name changes

Due to the implementation for building ARM64 packages on X86-64 hardware the versions of hestia-nginx / hestia-php has been changed the format used for 1.10 and forward.

• hestia-nginx-x.y.z-revision-os+release_architecture.deb
• hestia-php-x.y.z-revision-os+release_architecture.deb

It has no effect on the working. Both "hestia" package and "hestia-web-terminal" will follow in the future.

Security

• Unauthenticated Remote Code Execution via Session Deserialisation Mismatch in Web Terminal (GHSA-gh6f-9gpr-x9m2)
• IP Address Spoofing via CF-Connecting-IP Header (GHSA-73p3-rqpv-59wx)
• Cross-site Scripting (XSS) in Hestia Control Panel (GHSA-fg7j-gpvw-2m73)
• Client to Root RCE via Newline Injection in v-add-cron-job and Eval Stdout Poisoning in parse_object_kv_list (GHSA-5fpv-c8rg-x6r3)
• Systematic Second-Order Command Injection in Queue System Leading to Root RCE (GHSA-47mf-74xr-f8x9)
• Root RCE via double eval() on user-controlled config data in parse_object_kv_list() (func/main.sh) (GHSA-w3mx-xq85-8qqc)
• Low-privilege to root command execution via unescaped web.conf path fields evaluated by v-search-user-object (GHSA-cr7q-frhq-xw4v)
• HestiaCP 1.9.6 — SQL Injection in Database Password (CWE-89) (GHSA-8w7m-g9c2-9q9p)
• HestiaCP <= 1.9.6 Authenticated Admin Takeover (GHSA-fcq6-p8cj-xx3c)

Features

• Add: JSON files can now be edited directly in the File Manager (#5342)

Bug fixes

• Fix: Add validation for backup fields in v-schedule-user-restore (#5510)
• Improve security by removing eval from search utilities (#5509)
• Bump file manager to version 7.14.4 (#5508)
• Secure database user creation / password change to prevent SQL injection (#5511)
• Fix typo in $KEEP_MONTHLY on v-backup-user-restic (#5409)
• Allow installation to continue when netplan config is missing (#5406)
• Fix missing HESTIA variable by sourcing hestia.conf (#5433)
• Check SFTP jail status before add/delete user jail operations (#5420)
• Fix incorrect comment in web/add/mail/index.php (#5428)
• Fix private key detection not being propagated to sftpc() (#5426)
• Make v-extract-fs-archive fully non-interactive during extraction (#5436)
• Fix if statement in installer (#5440)
• Docs: Add mail cleanup guidance (#5371)
• Bump Roundcube to version 1.6.17 (#5492)