# CVE-2025-30007: HestiaCP OS command injection in DNS record management

Source: https://junglewise.ai/threats/cve-2025-30007-hestiacp-os-command-injection-in-dns-record-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2025-30007 · Severity: high · CVSS 8.8 · Published 2026-07-10

HestiaCP is an open-source control panel used to manage web servers and hosting environments. A security flaw allows a user with low-level access to take complete control of the server by injecting malicious code into DNS record settings. This could lead to a total system takeover, data theft, or service disruption, as the attacker gains the highest level of administrative (root) privileges.

Technologies: [HestiaCP](https://junglewise.ai/threats/technologies/hestiacp). Vendors: [HestiaCP](https://junglewise.ai/threats/vendors/hestiacp).

## Quick answers

**Is CVE-2025-30007 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-30007 being exploited in the wild.

**How severe is CVE-2025-30007?** High severity, with a CVSS score of 8.8, published 10 July 2026.

**Which products and versions are affected?** HestiaCP < 1.9.5.

**Is there a fix for CVE-2025-30007?** A patch was published on 2026-01-04: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-30007 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-30007?** Check whether you run HestiaCP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated OS command injection vulnerability exists in HestiaCP versions prior to 1.9.5. The flaw stems from insufficient input validation in the 'is_dns_record_format_valid()' function combined with unsafe eval-based parsing within 'update_domain_zone()'. By injecting a single-quote character into specific DNS record types, an attacker can prematurely close a variable assignment string to execute arbitrary shell commands. This allows a low-privilege authenticated user to achieve full root code execution on the underlying host. The issue is addressed in version 1.9.5 by hardening DNS record validation.

## Affected products

- HestiaCP HestiaCP < 1.9.5

## Timeline

- 2025-12-23: other: Initial pull request for hardening DNS validation submitted
- 2026-01-04: patched: Fix merged into main branch
- 2026-05-28: advisory: Release 1.9.5 published
- 2026-07-10: disclosed: CVE-2025-30007 published

## References

- [https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67](https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67)
- [https://github.com/hestiacp/hestiacp/pull/5197](https://github.com/hestiacp/hestiacp/pull/5197)
- [https://github.com/hestiacp/hestiacp/releases/tag/1.9.5](https://github.com/hestiacp/hestiacp/releases/tag/1.9.5)
- [https://www.vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management](https://www.vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management)

## Related threats

- [HestiaCP authorization bypass in cron job creation](https://junglewise.ai/threats/cve-2026-111627-hestiacp-before-1-10-5-contains-an-authorization-bypass)
- [HestiaCP stored XSS in DNS record management interface](https://junglewise.ai/threats/cve-2025-30008-hestiacp-stored-xss-in-dns-record-management-interface)
- [HestiaCP broken access control in panel cronjob feature](https://junglewise.ai/threats/cve-2026-12196-hestiacp-broken-access-control-in-panel-cronjob-feature)