PT-2026-57246 · Hestiacp · Hestiacp

Djibril Mounkoro · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2025-30007

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is dns record format valid() combined with unsafe eval-based parsing in update domain zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2025-30007

Produtos afetados

Hestiacp

Referências · 5

• https://github.com/hestiacp/hestiacp/releases/tag/1.9.5 · Nota
• https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67 · Correção
• https://github.com/hestiacp/hestiacp/pull/5197 · Nota
• https://vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-30007 · Nota de Segurança