Authenticated code execution via redirect configuration injection

Code injection in Hestia Control Panel before 1.6.6 allows remote authenticated users to gain administrator code execution via a crafted redirect. The v-add-web-domain-redirect command writes a user-supplied redirect into an included Nginx configuration after applying a permissive regular expression. A logged-in panel user who can manage a web domain can inject Nginx directives that route requests to attacker-controlled PHP executed as the administrator account.