CVE-2025-30007

What it is

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering, service disruption.

Exploit odds

3.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-10 19:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-29 19:10 UTC Last updatedMost recent change to the record

Details

Published

2026-07-10 19:17 UTC

Last modified

2026-09-29 19:10 UTC

Exploit probability

3.2% · EPSS, next 30 days

Weakness

CWE-78 · OS command injection

Record status

Analyzed

Affected

• Hestiacp Control Panel < 1.9.5

Attack profile CVSS 4.0 · 8.7

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High