Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-30008: HestiaCP lets low‑privilege users run malicious code in browsers

CVE-2025-30008 · published 3 months ago

Summary

In HestiaCP versions before 1.9.5, a user with limited rights can add a DNS entry containing special characters that hide code. When any user later views the DNS list, that hidden code runs in their web browser, potentially exposing data or allowing the attacker to act as that user. Upgrade the control panel to version 1.9.5 or later, and restrict low‑privilege accounts until the fix is applied.

What to do

Update hestiacp hestiacp to version 1.9.5 or later.
Update hestiacp control_panel to version 1.9.5 or later.

Affected software

Vendor	Product	Affected versions
hestiacp	hestiacp	< 1.9.5
hestiacp	control_panel	< 1.9.5 `cpe:2.3:a:hestiacp:control_panel::::::::`

Original advisory text

HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.

References

https://github.com/hestiacp/hestiacp/releases/tag/1.9.5 Vendor Advisory
https://www.vulncheck.com/advisories/hestiacp-stored-xss-via-dns-record-manageme... Vendor Advisory
https://github.com/hestiacp/hestiacp/pull/5196 Third Party Advisory
https://github.com/hestiacp/hestiacp/commit/07dda18ef0087ea981ff84d4d5757774cf21... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30008... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-30008 Vendor Advisory
https://github.com/hestiacp/hestiacp Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.0 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published10 Jul 2026

Updated3 Nov 2026

First seen10 Jul 2026

Sources

CVE-2025-30008 · NVD

CVE-2025-30008 · MITRE

CVE-2025-30008 · OSV

Track software like this

Free during beta