Is there a patch available for CVE-2025-30008?

Yes, a patch is available for CVE-2025-30008. Update the affected software to the latest version immediately.

HestiaCP CVE-2025-30008

Q: What is the CVSS score of CVE-2025-30008?

CVE-2025-30008 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210453 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 VulnCheck

GHSA-w2cw-hx5v-f37r

XSS PHP Hestiacp

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Low-privilege authentication required (PR:L), admin must view DNS list (UI:R), stored XSS changes scope to victim browser (S:C); server itself has no direct C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 19:01 vuln.today

DescriptionCVE.org

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.

AnalysisAI

Stored cross-site scripting in HestiaCP's DNS record management interface (all versions before 1.9.5) enables authenticated low-privilege users to execute arbitrary JavaScript in the browsers of any panel user who views the DNS record list, including administrators. The flaw in list_dns_rec.php allows injecting a script payload via a crafted DNS record value that breaks out of the data-sort-value HTML attribute due to missing htmlspecialchars() encoding - creating a persistent, privilege-escalating attack path from tenant-level access to admin session compromise. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch (v1.9.5) is available.

Technical ContextAI

HestiaCP is an open-source PHP-based web hosting control panel. The vulnerable component, list_dns_rec.php, renders DNS record values directly into the data-sort-value HTML attribute of list elements without applying PHP's htmlspecialchars() sanitization function. CWE-79 (Improper Neutralization of Input During Web Page Generation) covers this exact root cause class: unsanitized user-controlled data inserted into an HTML attribute context allows injection of a closing quote followed by arbitrary event handlers or script tags. The stored nature of the flaw means the payload persists in the application's data layer until the record is deleted or the system is patched, increasing dwell time compared to reflected XSS. CPE cpe:2.3:a:hestiacp:hestiacp:*:*:*:*:*:*:*:* confirms all HestiaCP versions prior to 1.9.5 are in scope.

RemediationAI

Upgrade HestiaCP to version 1.9.5 or later, which resolves the missing htmlspecialchars() encoding in list_dns_rec.php. The release is available at https://github.com/hestiacp/hestiacp/releases/tag/1.9.5, with the specific code fix in commit 07dda18ef0087ea981ff84d4d5757774cf2124b0 (PR #5196). Prior to patching, the most effective compensating control is to restrict DNS record creation and modification to trusted administrator accounts only, using HestiaCP's built-in role and permission controls; this eliminates the attack surface entirely but removes self-service DNS management for tenants. A secondary control is to audit existing DNS records for anomalous values containing HTML special characters (double-quotes, angle brackets, script keywords), which can identify already-planted payloads. No workaround short of access restriction fully mitigates the flaw in unpatched versions.