PT-2026-34634 · Froxlor · Froxlor

Offset · Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41230

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.6

Description The DomainZones::add() function accepts arbitrary DNS record types without a whitelist and fails to sanitize newline characters in the content variable. When a DNS type not covered by the validation chain is submitted, such as NAPTR, PTR, or HINFO, content validation is bypassed. Newline characters are stored in the database and written into BIND zone files via the DnsEntry:: toString() function. This allows an authenticated customer to inject arbitrary DNS records and BIND directives, including $INCLUDE, $ORIGIN, and $GENERATE, into their domain zone file.

Recommendations Update to version 2.3.6.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-41230

GHSA-47HF-23PW-3M8C

Affected Products

Froxlor

References · 7

• 🔥 https://github.com/froxlor/froxlor/security/advisories/GHSA-47hf-23pw-3m8c · Exploit
• https://github.com/froxlor/froxlor/commit/47a8af5d9523cb6ec94567405cfc2e294d3a1442 · Patch
• https://osv.dev/vulnerability/GHSA-47hf-23pw-3m8c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41230 · Security Note
• https://github.com/froxlor/froxlor · Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 · Note
• https://twitter.com/CVEnew/status/2047359886678278386 · Twitter Post