Threat Intelligence Database

HestiaCP versions before 1.9.5 have an authenticated OS command injection vulnerability. Low-privilege authenticated users can exploit insufficient input validation in DNS record handling to execute arbitrary commands as root. This occurs via injection of a single-quote character into unvalidated DNS record types, leveraging unsafe eval-based parsing. The vulnerability allows full root code execution on the host in a single DNS record creation step.

HestiaCP versions before 1.9.5 contain a stored cross-site scripting (XSS) vulnerability. Authenticated low-privilege users can inject arbitrary HTML by creating a DNS record with a crafted value containing a double-quote followed by a script payload. The vulnerability arises because the application does not apply htmlspecialchars() encoding to the DNS record value when rendering it into the data-sort-value HTML attribute in list_dns_rec.php. This allows the injected script to execute in the browsers of any users viewing the DNS record list, including administrators.