Executive brief
HestiaCP, an open-source control panel for web servers, is vulnerable to a security flaw where a low-privileged user can inject malicious scripts into the management interface. By creating a specially crafted DNS record, an attacker can target other users, including system administrators, who view the DNS record list. This could lead to unauthorized actions being performed in the administrator's session or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in HestiaCP versions prior to 1.9.5. The flaw is located in `list_dns_rec.php`, where the application fails to properly sanitize or encode the DNS record 'value' field before rendering it into the `data-sort-value` HTML attribute. An authenticated attacker with low privileges can exploit this by creating a DNS record containing a double-quote followed by a JavaScript payload. When an administrator or another user views the DNS record list, the payload executes in their browser. This vulnerability was addressed in version 1.9.5 by implementing a centralized `tohtml()` function that applies proper HTML entity encoding.
Affected products
- HestiaCP HestiaCP < 1.9.5
Timeline
- 2025-12-23: other: Initial pull request for fix submitted
- 2025-12-29: patched: Fix committed to main branch
- 2026-05-28: other: Version 1.9.5 released
- 2026-07-10: disclosed: CVE published and advisory released