PT-2026-27480 · Froxlor+1 · Froxlor+1

Q1Uf3Ng · Published 2026-03-24 · Updated 2026-05-29 · CVE-2026-30932

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.5

Description The DomainZones.add API endpoint, accessible to customers with DNS enabled, does not validate the content field for specific DNS record types (LOC, RP, SSHFP, TLSA). This allows an attacker to inject newlines and BIND zone file directives, such as $INCLUDE, into the zone file. When the DNS rebuild cron job runs, the modified zone file is written to disk. This can lead to information disclosure, DNS service disruption, and potential zone data manipulation. The vulnerable code resides in lib/Froxlor/Api/Commands/DomainZones.php (lines 213-214, 253-254, 290-291, 292-293) and lib/Froxlor/Dns/DnsEntry.php (line 83), and the zone file is written in lib/Froxlor/Cron/Dns/Bind.php (line 121). An example of exploitation involves using the curl command with the DomainZones.add command and injecting BIND directives into the content parameter of a LOC record. The API endpoint is ''/api.php'' and the vulnerable parameter is content.

Recommendations Update Froxlor to version 2.3.5 or later.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-30932

GHSA-J6FM-9RFM-J5HX

GHSA-X6W6-2XWP-3JH6

Affected Products

Bind

Froxlor

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30932.json · Exploit
• https://github.com/froxlor/froxlor/commit/b34829262dc32818b37f6a1eabb426d0b277a86b · Patch
• https://github.com/froxlor/froxlor/security/advisories/GHSA-x6w6-2xwp-3jh6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x6w6-2xwp-3jh6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30932 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30932 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6fm-9rfm-j5hx · Vendor Advisory
• https://github.com/froxlor/froxlor · Note
• https://github.com/froxlor/froxlor/security/advisories/GHSA-j6fm-9rfm-j5hx · Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.5 · Note
• https://twitter.com/dailycve/status/2060401447041196078 · Twitter Post
• https://twitter.com/cyberbivash/status/2036545814663745847 · Twitter Post
• https://twitter.com/dnsaudit/status/2040112089960996960 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://twitter.com/pulsepatchio/status/2038636269329420336 · Twitter Post