CVE-2025-30007

Name of the Vulnerable Software and Affected Versions HestiaCP versions prior to 1.9.5

Description An authenticated OS command injection allows low-privilege users to execute arbitrary commands as root. The issue stems from insufficient input validation in the is dns record format valid() function combined with unsafe eval-based parsing in the update domain zone() function. By injecting a single-quote character into unvalidated DNS record types, an attacker can prematurely close a variable assignment string and achieve full root code execution on the host during the creation of a DNS record.

Recommendations Update HestiaCP to version 1.9.5 or later.