CVE-2025-30008 is a stored XSS vulnerability in HestiaCP before version 1.9.5. It allows authenticated users with low privileges to inject arbitrary HTML/JavaScript by creating a specially crafted DNS record value containing a double-quote and script payload. The root cause is the failure to properly encode the DNS record value field when rendered into the data-sort-value HTML attribute in list_dns_rec.php, enabling script execution in the context of users viewing the DNS record list. This can lead to script execution in administrator browsers, potentially compromising administrative sessions.

The vulnerability enables stored cross-site scripting, allowing an attacker with low privileges to execute arbitrary scripts in the browsers of users who view the DNS record list, including administrators. This could lead to session hijacking, privilege escalation, or other malicious actions performed with the privileges of the affected users. However, exploitation requires authentication with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict low-privilege user access to DNS record creation or viewing, and apply strict input validation or output encoding as a temporary mitigation. Monitor vendor channels for an official fix or update to HestiaCP version 1.9.5 or later.