An authenticated OS command injection vulnerability in HestiaCP poses a high risk of total system compromise for affected control panel installations.

The application fails to properly neutralize special elements in DNS record management, leading to OS command injection. This vulnerability requires the attacker to have at least low-level authenticated access to the control panel to trigger the flaw.

The CVSS score of 8.8 reflects the high potential for full system control. Successful exploitation allows an authenticated user to execute arbitrary commands with the privileges of the web application, leading to data exfiltration, service disruption, and potential lateral movement within the hosting environment.

Immediate Action: Upgrade HestiaCP to version 1.9.5 or later immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review web server and system audit logs for suspicious process execution patterns or unexpected shell commands originating from the HestiaCP user context.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the impact if a command injection is successfully executed.

Public Exploit Available: false

Given the ability for an authenticated user to gain full command execution, this vulnerability represents a severe threat to server integrity. Administrators should prioritize the update to version 1.9.5 to eliminate this injection vector immediately.