Is CVE-2025-30008 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-30008 being exploited in the wild.

How severe is CVE-2025-30008?

Medium severity, with a CVSS score of 4.6, published 10 July 2026.

Is there a fix for CVE-2025-30008?

A patch was published on 2025-12-29: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-30008 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-30008?

Check whether you run HestiaCP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-30008: HestiaCP stored XSS in DNS record management interface

CVE-2025-30008 · Severity: medium · CVSS 4.6 · Published 2026-07-10

HestiaCP, an open-source control panel for web servers, is vulnerable to a security flaw where a low-privileged user can inject malicious scripts into the management interface. By creating a specially crafted DNS record, an attacker can target other users, including system administrators, who view the DNS record list. This could lead to unauthorized actions being performed in the administrator's session or the theft of sensitive session information.

Technologies: HestiaCP. Vendors: HestiaCP.

Quick answers

Is CVE-2025-30008 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-30008 being exploited in the wild.
How severe is CVE-2025-30008?: Medium severity, with a CVSS score of 4.6, published 10 July 2026.
Which products and versions are affected?: HestiaCP < 1.9.5.
Is there a fix for CVE-2025-30008?: A patch was published on 2025-12-29: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30008 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-30008?: Check whether you run HestiaCP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in HestiaCP versions prior to 1.9.5. The flaw is located in `list_dns_rec.php`, where the application fails to properly sanitize or encode the DNS record 'value' field before rendering it into the `data-sort-value` HTML attribute. An authenticated attacker with low privileges can exploit this by creating a DNS record containing a double-quote followed by a JavaScript payload. When an administrator or another user views the DNS record list, the payload executes in their browser. This vulnerability was addressed in version 1.9.5 by implementing a centralized `tohtml()` function that applies proper HTML entity encoding.

Affected products

HestiaCP HestiaCP < 1.9.5

Timeline

2025-12-23: other: Initial pull request for fix submitted
2025-12-29: patched: Fix committed to main branch
2026-05-28: other: Version 1.9.5 released
2026-07-10: disclosed: CVE published and advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.