← Vulnerability feed

Vulnerability record · CVE-2025-30007 · published 10 July 2026

CVE-2025-30007: Hestiacp control panel os command injection vulnerability

Hestiacp · Control Panel

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

8.7 CVSS 4.0 High EPSS 3.2% · top 12.2% CWE-78 · OS command injection
8.7CVSS 4.0 base score
3.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
20 Jul 2026Last modified by NVD

Description

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67 Patch
https://github.com/hestiacp/hestiacp/pull/5197 Issue TrackingPatch
https://github.com/hestiacp/hestiacp/releases/tag/1.9.5 Release Notes
https://www.vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management Third Party Advisory

Track CVE-2025-30007 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-3797Hestiacp control panel vulnerabilityhestiacp is vulnerable to Use of Wrong Operator in String ComparisonEPSS 1.1%8.8CVE-2022-2636Hestiacp control panel code injection vulnerabilityImproper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.EPSS 1.3%8.8CVE-2022-2550HestiaCP control panel OS command injectionHestiaCP versions prior to 1.6.5 contain an OS command injection flaw (CWE-78) in the control panel. A remote attacker with low-privileged credential…EPSS 48%analysed8.8CVE-2022-1509Hestiacp control panel command injection vulnerabilityCommand Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can exec…EPSS 4.5%7.8CVE-2023-5839Hestiacp control panel vulnerabilityPrivilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.EPSS 0.29%7.2CVE-2022-2626Hestiacp control panel vulnerabilityIncorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.EPSS 1.2%6.5CVE-2020-10966Hestiacp control panel vulnerabilityIn the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account…EPSS 1.9%6.1CVE-2023-3479Hestiacp control panel cross-site scripting vulnerabilityCross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2025-30007), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.