# Critical Issue with File Manager in Hestia v1.9.0~beta1

**URL:** <https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022>\
**Category:** Users\
**Created:** [December 15, 2024, 10:25pm UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022 "2024-12-15T22:25:17Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![3rKaN\_BRATTE](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/3/3d9bf3/32.png) [@3rKaN\_BRATTE](https://forum.hestiacp.com/u/3rKaN_BRATTE)\
**Post date:** [December 15, 2024, 10:25pm UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/1 "2024-12-15T22:25:17Z")

</div>

Yesterday, I installed the new beta version of Hestia (v1.9.0~beta1). After creating a new user, I attempted to use the File Manager. To my surprise, I found myself in the server’s root directory instead of the user’s home directory.

I was able to access files that I shouldn’t have permission to view. This issue seems critical, but I have no idea how to replicate it reliably. I’ve attached a video below demonstrating what happened.

Could you please confirm if this is a bug or if I’ve unintentionally broken something?

> **[Gyazo Screen Video](https://gyazo.com/32d8bf39d3cc8b895aaf228481bafc08)**
>
> Gyazo is the easiest way to record screenshots & videos you can share instantly. Save time with async visual communication that's effortless and engaging.

---

<div class="post-metadata">

**Author:** ![yunli](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/yunli/32/9695_2.png) [@yunli](https://forum.hestiacp.com/u/yunli)\
**Post date:** [December 16, 2024, 1:44am UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/2 "2024-12-16T01:44:57Z")

</div>

That’s because you’re using an administrator account. He is at the root of the current username, which is normal

---

<div class="post-metadata">

**Author:** ![3rKaN\_BRATTE](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/3/3d9bf3/32.png) [@3rKaN\_BRATTE](https://forum.hestiacp.com/u/3rKaN_BRATTE)\
**Post date:** [December 16, 2024, 1:57am UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/3 "2024-12-16T01:57:29Z")

</div>

This is not an administrator account, and if you suspect that I am havin this view because i am impersonating over an admin account, I have already verified this by logging in directly with this user account and i still can see every folder that i should not be able to see. This issue did not exist in previous versions

---

<div class="post-metadata">

**Author:** ![yunli](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/yunli/32/9695_2.png) [@yunli](https://forum.hestiacp.com/u/yunli)\
**Post date:** [December 16, 2024, 2:12am UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/4 "2024-12-16T02:12:27Z")

</div>

It should be the reason for the server itself. You can test it out with a different server provider

We didn’t find this issue in our tests, so you can share which server provider you are using. It can help to confirm if it’s a server issue or a Hestia issue

---

<div class="post-metadata">

**Author:** ![3rKaN\_BRATTE](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/3/3d9bf3/32.png) [@3rKaN\_BRATTE](https://forum.hestiacp.com/u/3rKaN_BRATTE)\
**Post date:** [December 16, 2024, 8:58am UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/5 "2024-12-16T08:58:20Z")

</div>

I am running it in my own virtual KVM environment using Proxmox and Cloud-Init on Ubuntu 24.04 i don’t think it has something to do with that

---

<div class="post-metadata">

**Author:** ![eris](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/eris/32/1241_2.png) [@eris](https://forum.hestiacp.com/u/eris)\
**Post date:** [December 16, 2024, 9:06am UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/6 "2024-12-16T09:06:32Z")

</div>

Disable shell and it should work fine

---

<div class="post-metadata">

**Author:** ![3rKaN\_BRATTE](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/3/3d9bf3/32.png) [@3rKaN\_BRATTE](https://forum.hestiacp.com/u/3rKaN_BRATTE)\
**Post date:** [December 16, 2024, 8:50pm UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/7 "2024-12-16T20:50:24Z")

</div>

What exactly do you mean by that? Are you referring to ‘jail user shell’ or something else?

> **[Gyazo](https://gyazo.com/e5c592ae4e27185fdb433aef04b4c275)**
>
> Gyazo is the easiest way to record screenshots & videos you can share instantly. Save time with async visual communication that's effortless and engaging.

Edit: After enabling the shell to Bash and selecting ‘Jail User Shell,’ it is now working again

---

<div class="post-metadata">

**Author:** ![eris](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/eris/32/1241_2.png) [@eris](https://forum.hestiacp.com/u/eris)\
**Post date:** [December 17, 2024, 6:43am UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/8 "2024-12-17T06:43:42Z")

</div>

No set Shell access to nologin…

---

<div class="post-metadata">

**Author:** ![3rKaN\_BRATTE](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/3/3d9bf3/32.png) [@3rKaN\_BRATTE](https://forum.hestiacp.com/u/3rKaN_BRATTE)\
**Post date:** [December 17, 2024, 9:09am UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/9 "2024-12-17T09:09:36Z")

</div>

If I reset it back to ‘nologin,’ I can once again view the full server directory tree 😕

---

<div class="post-metadata">

**Author:** ![3rKaN\_BRATTE](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/3/3d9bf3/32.png) [@3rKaN\_BRATTE](https://forum.hestiacp.com/u/3rKaN_BRATTE)\
**Post date:** [December 17, 2024, 6:15pm UTC](https://forum.hestiacp.com/t/critical-issue-with-file-manager-in-hestia-v1-9-0-beta1/17022/10 "2024-12-17T18:15:00Z")

</div>

@eris Is there any fix for it? Or should I stick with version 1.8.12 for now?

I’m just currently in the process of migrating my server and thought it would be a good opportunity to start fresh with the latest Ubuntu version
