CVE-2025-30007highCWE-78

CVE-2025-30007: high-severity vulnerability in hestiacp

HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

Published · Updated

Follow this CVE+ Monitor hestiacp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 3.2%
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
hestiacp · hestiacp
Related CVEs — hestiacp

In the same product, most dangerous first.

CVE-2026-43633CRITICALHestiaCP 1.9.0-1.9.4 Deserialization RCE via Web TerminalEPSS 1.1%CVE-2026-108390CRITICALHestiaCP Low-Privileged User to Root via Config-Field Injection and PATH HijackingEPSS 0.7%CVE-2026-111627HIGHHestiaCP before 1.10.5 Protected Admin Bypass via Cron Job CreationEPSS 0.6%CVE-2026-12196HIGHHestiaCP Admin TakeoverEPSS 0.4%CVE-2025-30008MEDIUMHestiaCP < 1.9.5 Stored XSS via DNS Record Management InterfaceEPSS 0.3%CVE-2026-43634HIGHHestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP HeaderEPSS 0.2%