PT-2026-34634 · Froxlor · Froxlor

Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-41230

Mitre

CVSS v3.1

8.5

High

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Froxlor is open source server administration software. Prior to version 2.3.6, DomainZones::add() accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the content field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g., NAPTR, PTR, HINFO), content validation is entirely bypassed. Embedded newline characters in the content survive trim() processing, are stored in the database, and are written directly into BIND zone files via DnsEntry:: toString(). An authenticated customer can inject arbitrary DNS records and BIND directives ($INCLUDE, $ORIGIN, $GENERATE) into their domain's zone file. Version 2.3.6 fixes the issue.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-41230

Affected Products

Froxlor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41230 · Security Note
• https://github.com/froxlor/froxlor/security/advisories/GHSA-47hf-23pw-3m8c · Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 · Note
• https://github.com/froxlor/froxlor/commit/47a8af5d9523cb6ec94567405cfc2e294d3a1442 · Note