CVE-2025-30008: HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in listdnsrec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30008?
The severity of CVE-2025-30008 is rated as medium with a score of 4.6.
What vulnerability does CVE-2025-30008 describe?
CVE-2025-30008 describes a stored cross-site scripting vulnerability in HestiaCP that allows low-privilege authenticated users to inject arbitrary HTML.
How do I fix CVE-2025-30008?
To fix CVE-2025-30008, update HestiaCP to version 1.9.5 or later where the vulnerability has been patched.
Who is affected by CVE-2025-30008?
CVE-2025-30008 affects users of HestiaCP prior to version 1.9.5, particularly those with low privileges.
What can attackers do with CVE-2025-30008?
Attackers can exploit CVE-2025-30008 to inject malicious scripts through the DNS record management interface, potentially leading to unauthorized actions within the application.