PT-2026-27480 · Froxlor · Froxlor

Q1Uf3Ng · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-30932

NVD

CVSS v4.0

8.6

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-30932

Affected Products

Froxlor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30932 · Security Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.5 · Note
• https://github.com/froxlor/froxlor/commit/b34829262dc32818b37f6a1eabb426d0b277a86b · Note
• https://github.com/froxlor/froxlor/security/advisories/GHSA-x6w6-2xwp-3jh6 · Note