PT-2026-57246 · Hestiacp · Hestiacp

Djibril Mounkoro · Published 2026-07-10 · Updated 2026-07-10 · CVE-2025-30007

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is dns record format valid() combined with unsafe eval-based parsing in update domain zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-30007

Affected Products

Hestiacp

References · 5

• https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-30007 · Security Note
• https://github.com/hestiacp/hestiacp/releases/tag/1.9.5 · Note
• https://github.com/hestiacp/hestiacp/pull/5197 · Note
• https://vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management · Note