CVE-2025-30007: Hestiacp Control Panel RCE Vulnerability

CVE-2025-30007 Overview

CVE-2025-30007 is an authenticated operating system (OS) command injection vulnerability in HestiaCP control panel versions before 1.9.5. Low-privilege authenticated users can execute arbitrary commands as root by injecting a single-quote character into unvalidated Domain Name System (DNS) record types. The flaw resides in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone(). Attackers close a variable assignment string prematurely and achieve full root code execution in a single DNS record creation step. The vulnerability maps to [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Any authenticated HestiaCP user with DNS record management permissions can escalate to root on the underlying host through a single crafted DNS record.

Affected Products

HestiaCP Control Panel versions prior to 1.9.5
Deployments exposing the HestiaCP web interface to authenticated tenants
Multi-tenant hosting environments running vulnerable HestiaCP builds

Discovery Timeline

2026-07-10 - CVE-2025-30007 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2025-30007

Vulnerability Analysis

HestiaCP exposes DNS record management to authenticated panel users through shell scripts including bin/v-add-dns-record and bin/v-change-dns-record. These scripts accept a record type (rtype) and value (dvalue) supplied by the user and pass them through validation routines before writing the record.

The validation function is_dns_record_format_valid() fails to reject dangerous metacharacters, notably the single-quote character, from the record type field. Downstream, update_domain_zone() uses shell eval-based parsing to assemble variable assignments from user input. A single quote in the rtype value terminates the assignment string early and allows the attacker to append arbitrary shell tokens.

Because the DNS management scripts execute under root through the HestiaCP privilege model, injected commands run with full root privilege on the host. Exploitation completes in one request to create or modify a DNS record.

Root Cause

The root cause is insufficient input validation combined with unsafe string interpolation in bash. The validator accepted characters that carry shell meaning, and the consumer code embedded those characters into unquoted or single-quoted contexts parsed by eval semantics.

Attack Vector

The attacker authenticates to HestiaCP with any account holding DNS record permissions. They submit a crafted DNS record creation request where the record type field contains a single quote followed by shell commands. The panel writes the value into a bash context where it is evaluated as code.

text

// Vendor patch: bin/v-add-dns-record - harden dns record validation (#5197)
 if [ "$rtype" != "CAA" ]; then
 	dvalue=${dvalue//\"/}
-	# Add support for DS key
-	if [ "$rtype" != "DNSKEY" ] && [ "$rtype" != "DS" ] && [ "$rtype" != "TLSA" ]; then
-		if [ "$rtype" != 'SRV' ] && [[ "$dvalue" =~ [\;[:space:]] ]]; then
-			dvalue='"'"$dvalue"'"'
-		fi
-	fi
+	case "$rtype" in
+		SRV | DNSKEY | DS | TLSA | KEY | IPSECKEY) ;;
+		*)
+			if [[ "$dvalue" =~ [\;[:space:]] ]]; then
+				dvalue='"'"$dvalue"'"'
+			fi
+			;;
+	esac
 fi

// Source: https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67

The patch replaces the loose if/else chain with a case statement covering SRV, DNSKEY, DS, TLSA, KEY, and IPSECKEY, and canonicalizes single quotes in v-change-dns-record via current_value_canon=${VALUE//\'/%quote%}.

Detection Methods for CVE-2025-30007

Indicators of Compromise

DNS record entries in HestiaCP zone files containing single-quote characters, backticks, or shell metacharacters in the record type or value fields.
Unexpected root-owned processes spawned by bin/v-add-dns-record or bin/v-change-dns-record parent chains.
New cron jobs, SSH keys, or user accounts created shortly after DNS record API calls in HestiaCP access logs.
Outbound network connections from the HestiaCP host to unfamiliar hosts following DNS record modifications.

Detection Strategies

Audit HestiaCP action logs at /usr/local/hestia/log/ for v-add-dns-record and v-change-dns-record invocations containing ', ;, $(, or backtick characters in arguments.
Correlate DNS record creation events with subsequent process executions under the root user to identify anomalous command chains.
Baseline expected DNS record types (A, AAAA, MX, TXT, CNAME, NS, SRV, CAA) and alert on values that deviate from RFC-compliant syntax.

Monitoring Recommendations

Monitor endpoint telemetry for bash, sh, curl, or wget processes whose parent is a HestiaCP DNS management script.
Alert on file writes to /etc/passwd, /root/.ssh/authorized_keys, or /etc/cron.d/ originating from web-tier processes.
Forward HestiaCP application and shell audit logs to a centralized data lake for retrospective hunting.

How to Mitigate CVE-2025-30007

Immediate Actions Required

Upgrade HestiaCP to version 1.9.5 or later immediately, as documented in the GitHub Release Tag 1.9.5.
Review all HestiaCP user accounts and revoke access for any account that does not require DNS record management.
Audit existing DNS zone files for records containing suspicious characters and remove any unauthorized entries.
Rotate credentials, SSH keys, and API tokens on hosts running vulnerable HestiaCP builds until patch verification is complete.

Patch Information

The fix ships in HestiaCP 1.9.5 via commit a74babb739aa92e52b12d6ef52b6b9428ffbbb67 and pull request #5197. The patch introduces a case statement that explicitly whitelists DNS record types requiring unquoted values and canonicalizes single quotes before variable comparison. See the GitHub Commit Update, GitHub Pull Request Review, and VulnCheck Security Advisory for details.

Workarounds

Restrict HestiaCP panel access to trusted administrators only until the upgrade to 1.9.5 completes.
Place the HestiaCP web interface behind a virtual private network (VPN) or IP allowlist to reduce the exposed attack surface.
Disable DNS record management for non-administrative users through HestiaCP role configuration where feasible.

bash

# Upgrade HestiaCP to the patched release
bash /usr/local/hestia/bin/v-update-sys-hestia-all

# Verify installed version is 1.9.5 or later
/usr/local/hestia/bin/v-list-sys-info | grep -i version