Hestiacp: Security Vulnerabilities
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.
CVSS Score
5.1
EPSS Score
0.002
Published
2026-07-10
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.
CVSS Score
8.7
EPSS Score
0.021
Published
2026-07-10
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
CVSS Score
8.8
EPSS Score
0.003
Published
2023-10-29
Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
CVSS Score
3.2
EPSS Score
0.004
Published
2023-10-13
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
CVSS Score
3.9
EPSS Score
0.004
Published
2023-09-20
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.
CVSS Score
4.3
EPSS Score
0.013
Published
2023-06-30
An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
CVSS Score
7.5
EPSS Score
0.006
Published
2022-08-18
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score
6.1
EPSS Score
0.005
Published
2022-08-18
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS Score
8.5
EPSS Score
0.011
Published
2022-08-05
Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS Score
9.1
EPSS Score
0.011
Published
2022-08-05
Page 1