CVE-2025-30007

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67	Patch
https://github.com/hestiacp/hestiacp/pull/5197	Issue Tracking Patch
https://github.com/hestiacp/hestiacp/releases/tag/1.9.5	Release Notes
https://www.vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hestiacp:control_panel:*:*:*:*:*:*:*:*

History

29 Sep 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) HestiaCP anterior a la versión 1.9.5 contiene una vulnerabilidad de inyección de comandos del sistema operativo autenticada que permite a usuarios autenticados con bajos privilegios ejecutar comandos arbitrarios como root inyectando un carácter de comilla simple en tipos de registros DNS no validados. Los atacantes pueden explotar la validación de entrada insuficiente en is_dns_record_format_valid() combinada con el análisis inseguro basado en eval en update_domain_zone() para cerrar prematuramente una cadena de asignación de variables y lograr la ejecución completa de código como root en el host subyacente en un solo paso de creación de registro DNS.

Information

Published : 2026-07-10 19:17

Updated : 2026-09-29 19:10

NVD link : CVE-2025-30007

Mitre link : CVE-2025-30007

CVE.ORG link : CVE-2025-30007

JSON object : View

Products Affected

hestiacp

control_panel

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-30007", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30007", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T18:26:22.196644Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/hestiacp/hestiacp", "vendor": "hestiacp", "product": "hestiacp", "versions": [{"status": "affected", "version": "0", "lessThan": "1.9.5", "versionType": "semver"}], "packageURL": "pkg:github/hestiacp/hestiacp", "defaultStatus": "affected"}]}], "published": "2026-07-10T19:17:18.130", "references": [{"url": "https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/hestiacp/hestiacp/pull/5197", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/hestiacp/hestiacp/releases/tag/1.9.5", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step."}, {"lang": "es", "value": "HestiaCP anterior a la versi\u00f3n 1.9.5 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo autenticada que permite a usuarios autenticados con bajos privilegios ejecutar comandos arbitrarios como root inyectando un car\u00e1cter de comilla simple en tipos de registros DNS no validados. Los atacantes pueden explotar la validaci\u00f3n de entrada insuficiente en is_dns_record_format_valid() combinada con el an\u00e1lisis inseguro basado en eval en update_domain_zone() para cerrar prematuramente una cadena de asignaci\u00f3n de variables y lograr la ejecuci\u00f3n completa de c\u00f3digo como root en el host subyacente en un solo paso de creaci\u00f3n de registro DNS."}], "lastModified": "2026-09-29T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hestiacp:control_panel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B703027-3F35-4B64-BA33-09BBEB43BF13", "versionEndExcluding": "1.9.5"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}