Anyone tested the 1.9.5 release yet on Debian?

[jperkins]

Release 1.9.5 Service Release · hestiacp/hestiacp

apt list --upgradable
Listing… Done
…
hestia-nginx/bookworm 1.30.2 amd64 [upgradable from: 1.27.4]
hestia-php/bookworm 8.4.21 amd64 [upgradable from: 8.3.17]
hestia-web-terminal/bookworm 1.0.3 amd64 [upgradable from: 1.0.2]
hestia/bookworm 1.9.5 amd64 [upgradable from: 1.9.4]

…

Havent seen an announcement but it was just released. Thanks so much

[jekasumy]

Please, configure your HTTP server to point to the /public_html directory (with fallback to /public_html/index.php.

========

I updated to my own detriment. Problems arose after the update.

[jekasumy]

You simply forgot to include template fixes in the updates…

DOC: How to update Roundcube to version 1.6.13 (fixes 2 security vulnerabilities)

Hi, Today, February 8h, 2026 has been released Roundcube 1.6.13 and it fixes two security vulnerabilities. Security fixes Fix CSS injection vulnerability reported by CERT Polska. Fix remote image blocking bypass via SVG content reported by nullcathedral. More info about the release: I’ve created this PR to bump Roundcube version to 1.6.13: If you want to update Roundcube now, you can do it manually using below steps. Disclaimer: it should work fine BUT use this procedure at your own …

[jekasumy]

If you have 1.7, don’t update!

Why in the update 1.9.5 old Rooundcube?

====

The same web terminal keeps breaking.
Everything works really badly after the update. Honestly, it’s not worth updating. I don’t understand where all those major fixes for so many issues went!

========

If anyone’s web terminal crashes, do the following:

cd /usr/local/hestia/web-terminal/

npm install node-pty --save
npm install express socket.io --save

=====

2026-05-28T14:04:39.092983-04:00 server.js[2401359]: New connection from 93.170.67.224 (otq6piiu1qkkpk0b1tsdeqo3ng)
2026-05-28T14:04:39.110120-04:00 server.js[2401359]: Could not open input file: /usr/local/hestia/web-terminal/web-terminal-session-auth.php
2026-05-28T14:04:39.110383-04:00 server.js[2401359]: Session helper failed for otq6piiu1qkkpk0b1tsdeqo3ng, refusing connection: Command failed: /usr/local/hestia/php/bin/php /usr/local/hestia/web-terminal/web-terminal-session-auth.php otq6piiu1qkkpk0b1tsdeqo3ng
2026-05-28T14:04:39.110414-04:00 server.js[2401359]: Could not open input file: /usr/local/hestia/web-terminal/web-terminal-session-auth.php

But I don’t understand what kind of file it started requiring in the first place. It never existed.

====

Fixing a web terminal error:

cd /usr/local/hestia/web-terminal && wget https://raw.githubusercontent.com/hestiacp/hestiacp/refs/heads/main/src/deb/web-terminal/web-terminal-session-auth.php

===

I have great respect for the developers, but I think releasing such a bad update was a hasty decision!

[Raphael]

@jekasumy

Everything works really badly after the update. Honestly, it’s not worth updating.

Can you please write, what you mean with “everything”?

[jekasumy]

1. Cfg[‘TempDir’] (/usr/share/phpmyadmin/tmp/) - An error occurred in phpmyadmin.
2. I updated to Roundcube 1.7.X, but you didn’t include all the changes you made in the update. This broke the web client.
3. The web terminal crashed. The file it started requesting simply didn’t appear in the folder after the update. I wrote above how to fix this.

I’m still monitoring what problems might arise. There might be more. The update is very buggy!

[jekasumy]

The $cfg[‘TempDir’] (/usr/share/phpmyadmin/tmp/) is not accessible. phpMyAdmin is not able to cache templates and will be slow because of this.

I’ve been struggling for an hour and don’t know how to fix it. I’ve tried setting all the possible permissions.

[nu01]

I too am getting Error Code: SSL_ERROR_BAD_CERT_DOMAINon my webmail. I did not realise to check the forum first, and now I am struggling for 40+ minutes myself.

[sahsanu]

The fix for that issue is here:

Call for Testers: Roundcube 1.7-beta & Updated Mail Templates

I’ve found the bug. Try this fix and let me know whether it solves the issue before I open a PR. sed -i.ori 's/"\$WEBMAIL")/"WEBMAIL")/' /usr/local/hestia/bin/v-rebuild-mail-domain for user in $(/usr/local/hestia/bin/v-list-users plain | cut -f1); do if [[ "$("/usr/local/hestia/bin/v-list-user" "$user" json | jq -r '.[]|.U_MAIL_DOMAINS')" -ge 1 ]]; then echo "${B}[ + ]${N} Rebuilding mail domains for user $user"; /usr/local/hestia/bin/v-rebuild-mail-domains "$user";fi;done

I need testers to confirm whether the fix works before creating the PR.

[nu01]

I did that, and now, as @jekasumy I am stuck in: Please, configure your HTTP server to point to the /public_html directory (with fallback to /public_html/index.php.

[sahsanu]

You are using PHP 1.7.1 and I was clear, it is only for test servers. If Hestia didn’t include the merge that adds support to 1.7.x… then… you know

Anyway, to fix it:

sed -i 's/1\.7\.1/1.7.0/' /var/lib/roundcube/program/include/iniset.php
curl -fsSLm15 https://7j.gg/updrc17 | sudo bash -s --

[nu01]

Ohh right. Sorry, it is 1 AM my side, and I am groggy, and did the upgrade without giving any thoughts.

[nu01]

Working fine now.
Now upgrading second server, and I hope all my stuff work. lols.

[jekasumy]

Upload templates here /usr/local/hestia/data/templates/mail

templates - wget -qO- https://7j.gg/rc17tpl | tar xf - -C /usr/local/hestia/data/templates/

After that, you can test disabling and re-enabling roundcube for a specific domain.

===

I won’t be updating the panel at all until all changes made by people who care about this project are globally implemented. What’s currently being done is breaking a lot of servers!

[jekasumy]

The $cfg[‘TempDir’] (/usr/share/phpmyadmin/tmp/) is not accessible. phpMyAdmin is not able to cache templates and will be slow because of this.

I have no idea how to fix this…

[sahsanu]

@jekasumy

I have no idea how to fix this…

That isn’t related to Hestia 1.9.5, that happens also in 1.9.4 and it’s because the new services for PHP-FPM. The new services add extra security into the systemd services.

If your PHP default version is 8.4:

mkdir -p /etc/systemd/system/php8.4-fpm.service.d/
echo -e '[Service]\nReadWritePaths="/usr/share/phpmyadmin/tmp/"' > /etc/systemd/system/php8.4-fpm.service.d/override.conf
systemctl daemon-reload
systemctl restart php8.4-fpm.service

[nu01]

& probably this helps: The $cfg['TempDir'] (/usr/share/phpmyadmin/tmp/) is not accessible. Debian 12 - #21 by sahsanu

[sahsanu]

@nu01

probably this helps

No, that’s not the problem, check my previous post.

[nu01]

Okay installed on the second server (upgraded), and everything is working for now. I am not gonna do a reboot now, as I really need to sleep. But will do so tomorrow and check.

[jekasumy]

It costs 8.3 by default.