Skip to content
Threat Feed
Subscribe

Vendor

HestiaCP

3 briefs RSS
high advisory

HestiaCP Authenticated OS Command Injection via DNS Record Types (CVE-2025-30007)

An authenticated OS command injection vulnerability, CVE-2025-30007, in HestiaCP before version 1.9.5 allows low-privilege users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types, leading to full root code execution on the underlying host.

HestiaCP < 1.9.5 vulnerability command-injection privilege-escalation linux hestiacp
2t 1c
high advisory

HestiaCP IP Spoofing Vulnerability (CVE-2026-43634)

HestiaCP versions 1.2.0 through 1.9.4 are vulnerable to IP spoofing (CVE-2026-43634), allowing unauthenticated remote attackers to bypass authentication security controls by manipulating the CF-Connecting-IP HTTP header to circumvent fail2ban, bypass IP allowlists, and poison authentication logs.

HestiaCP ip-spoofing authentication-bypass cve
2r 1t 1c
critical threat

HestiaCP Deserialization Vulnerability (CVE-2026-43633)

HestiaCP versions 1.9.0 through 1.9.4 are vulnerable to unauthenticated remote code execution due to a deserialization flaw in the web terminal component (CVE-2026-43633), stemming from a session format mismatch between PHP and Node.js, allowing attackers to inject malicious data via HTTP headers.

HestiaCP 1.9.0 +4 deserialization rce cve
2r 1t 1c