hestiacp/web/update/hestia/index.php

<?php
use function Hestiacp\quoteshellarg\quoteshellarg;

// Init
ob_start();
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");

// Check token
verify_csrf($_GET);

if ($_SESSION['userContext'] === 'admin') {
    if (!empty($_GET['pkg'])) {
        $v_pkg = quoteshellarg($_GET['pkg']);
        exec(HESTIA_CMD."v-update-sys-hestia ".$v_pkg, $output, $return_var);
    }

    if ($return_var != 0) {
        $error = implode('<br>', $output);
        if (empty($error)) {
            $error = sprintf(_('Error: %s update failed', $v_pkg));
            $_SESSION['error_msg'] = $error;
        }
    }
    unset($output);
}

header("Location: /list/updates/");
exit;