The vulnerability in HestiaCP prior to version 1.9.5 arises from improper input validation in the function is_dns_record_format_valid() combined with unsafe use of eval in update_domain_zone(). An attacker with low-privilege authenticated access can inject a single-quote character into DNS record types, prematurely closing a variable assignment string. This leads to arbitrary command execution as root on the underlying host. The issue is categorized as CWE-78 (OS Command Injection). No patch or remediation details are provided in the input data.

Successful exploitation allows low-privilege authenticated users to execute arbitrary commands with root privileges on the host running HestiaCP. This can lead to full system compromise, unauthorized access, data theft, or disruption of services. The vulnerability is high severity due to the privilege escalation and root-level code execution it enables.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious DNS record creation activities. Avoid exposing HestiaCP interfaces to untrusted users.