CVE-2025-30008

Medium

Description

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.

SeverityMedium

CVSS4.6

Exploit probability—

ProductHestiacp Control Panel

PublishedJul 10, 2026

First seenJul 10, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

hestiacp control_panel1.9.5 or later

Patches

github.com/hestiacp/hestiacp/commit/07dda18ef0087ea981ff84d4d5757774cf2124b0

Vendor advisories

github.com/hestiacp/hestiacp/releases/tag/1.9.5

Affected products

Product	Affected versions	Fixed in
hestiacp control_panel	v < 1.9.5	1.9.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.