Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2025-30007HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

High 8.8

In plain English

A high-severity OS command injection in hestiacp from hestiacp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)3.2%top 11.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

Affected products (as reported)

Vendor	Product	Versions
hestiacp	hestiacp	0 – before 1.9.5

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management third-party-advisory