Authenticated OS Command Injection in HestiaCP by HestiaCP

CVE-2025-30007

What is CVE-2025-30007?

HestiaCP versions before 1.9.5 are susceptible to an authenticated OS command injection vulnerability that enables low-privileged authenticated users to execute arbitrary commands as root. This exploit stems from inadequate input validation in handling DNS record types. By injecting a single-quote character, attackers can manipulate the parsing mechanism used in DNS record creation, bypassing security checks to achieve full root access on the host. This vulnerability highlights the critical need for robust input validation and secure coding practices to mitigate potential exploits.

References