CVE-2025-30008 Overview
CVE-2025-30008 is a stored cross-site scripting (XSS) vulnerability in HestiaCP versions before 1.9.5. The flaw exists in the DNS record management interface, where the application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php. Authenticated low-privilege users can inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The payload executes in the browser of any user viewing the DNS record list, including administrators. This weakness is tracked under [CWE-79].
Critical Impact
A low-privilege authenticated attacker can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover of the HestiaCP control panel.
Affected Products
- HestiaCP Control Panel versions prior to 1.9.5
- Hosting environments exposing the HestiaCP web management interface
- Multi-tenant deployments where low-privilege users can create DNS records
Discovery Timeline
- 2026-07-10 - CVE-2025-30008 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2025-30008
Vulnerability Analysis
The vulnerability resides in the DNS record listing view of the HestiaCP control panel. The file list_dns_rec.php renders user-supplied DNS record values into the data-sort-value HTML attribute without sanitization. Because the value is embedded inside a double-quoted HTML attribute, an attacker can supply a payload containing a double-quote character to break out of the attribute context and inject additional HTML tags or event handlers.
When an administrator or any other authenticated user visits the DNS record list, the injected markup renders in their browser and the JavaScript executes under the origin of the HestiaCP interface. Because HestiaCP administrators possess broad control over hosted services, mail, DNS, and shell accounts, session hijacking through this XSS can lead to full compromise of the server.
Root Cause
The root cause is missing output encoding. The affected template concatenates the DNS record value directly into an HTML attribute without invoking htmlspecialchars() or an equivalent encoding routine. The fix, delivered in commit 07dda18ef0087ea981ff84d4d5757774cf2124b0, applies proper HTML attribute encoding before rendering the value.
Attack Vector
Exploitation requires an authenticated account with permission to create DNS records. The attacker submits a DNS record whose value contains a double-quote character followed by an HTML fragment, such as an event handler or <script> tag. When another user, typically an administrator reviewing zone contents, opens the DNS record list, the browser parses and executes the injected content. User interaction is required, as the payload only triggers when the listing page is loaded. See the Vulncheck Security Advisory for additional technical detail.
Detection Methods for CVE-2025-30008
Indicators of Compromise
- DNS records containing embedded double-quote characters followed by HTML markup or event handler attributes such as onerror, onload, or <script> fragments.
- Web server access logs showing DNS record creation requests to the HestiaCP API from low-privilege user accounts immediately preceding administrator sessions loading list_dns_rec.php.
- Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after opening the DNS management interface.
Detection Strategies
- Audit stored DNS zone data for records whose value fields contain the characters ", <, >, or JavaScript keywords such as script, onerror, or onload.
- Inspect HestiaCP web server logs for POST requests to DNS record creation endpoints containing URL-encoded angle brackets or quote characters in the value parameter.
- Deploy a content security policy (CSP) in report-only mode to surface inline script execution originating from the control panel interface.
Monitoring Recommendations
- Monitor for anomalous administrator session activity following DNS record creation events by non-admin users.
- Log and alert on modifications to DNS records that include non-standard characters outside the RFC-compliant character set for the record type.
- Correlate control panel authentication events with DNS management page loads to identify potential session hijacking attempts.
How to Mitigate CVE-2025-30008
Immediate Actions Required
- Upgrade HestiaCP to version 1.9.5 or later, which contains the fix in commit 07dda18ef0087ea981ff84d4d5757774cf2124b0.
- Review existing DNS records across all hosted zones for payloads containing HTML or JavaScript content and remove them.
- Rotate administrator credentials and invalidate active sessions if suspicious DNS entries are discovered.
Patch Information
The vulnerability was remediated in HestiaCP Release 1.9.5. The corresponding code change is documented in the GitHub Pull Request #5196 and the GitHub Commit Update, which introduces HTML encoding for the DNS record value field before it is rendered into the data-sort-value attribute in list_dns_rec.php.
Workarounds
- Restrict DNS record creation privileges to trusted administrative users until the patched version is deployed.
- Enforce a strict Content Security Policy on the HestiaCP interface to block inline script execution and mitigate XSS impact.
- Require administrators to use isolated browser profiles or dedicated management workstations when reviewing DNS zones on unpatched installations.
# Upgrade HestiaCP to a patched release
cd /usr/local/hestia
bash /usr/local/hestia/install/upgrade.sh
v-list-sys-info | grep VERSION
# Confirm reported version is 1.9.5 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
