Argument-Injection on Ravindu Lakmina Munaweera

Argument-Injection on Ravindu Lakmina Munaweera - Security Research https://ravindulakmina.pages.dev/tags/argument-injection/ Recent content in Argument-Injection on Ravindu Lakmina Munaweera - Security Research Hugo en-us Wed, 14 Oct 2026 00:00:00 +0000 CVE-2026-108390: From a Stray Apostrophe to Root — Escalating a Standard HestiaCP Account to Full Server Compromise https://ravindulakmina.pages.dev/advisories/cve-2026-108390-hestiacp-apostrophe-to-root/ Wed, 14 Oct 2026 00:00:00 +0000 https://ravindulakmina.pages.dev/advisories/cve-2026-108390-hestiacp-apostrophe-to-root/ A single quote in a directory name lets any standard HestiaCP user account escalate to root. Reported, confirmed, and fixed in HestiaCP 1.10.5. GHSA-r9q4-pmcm-5qqf, CVE-2026-108390, CVSS 9.9.