Executive brief
Froxlor is an open-source server management panel used to administer web hosting environments. A security flaw allows authorized customers with DNS management permissions to inject malicious commands into the server's DNS configuration files. This could allow an attacker to redirect web traffic, intercept emails, or view sensitive system files on the hosting server, potentially leading to a full compromise of the DNS service for their domains.
Technical details
The `DomainZones.add` API endpoint fails to sanitize newline characters in the `content` field when the record type is set to `TXT`. This is an incomplete fix for a previous vulnerability (CVE-2026-30932) which addressed other record types but omitted TXT. An authenticated attacker with DNS editing privileges can use newline characters (`\n`) to break out of the TXT record context in the generated BIND zone file. This allows the injection of arbitrary BIND directives such as `$INCLUDE` (to read local files like `/etc/passwd`) or `$GENERATE`, as well as the creation of unauthorized A, MX, or CNAME records. The vulnerability is exploited when the DNS rebuild cron job writes the unsanitized content to disk. The issue is resolved in version 2.3.7.
Affected products
- Froxlor Froxlor < 2.3.7
Timeline
- 2026-05-15: patched: Version 2.3.7 released
- 2026-06-03: advisory: GitHub Security Advisory GHSA-37m5-m4q3-fc6x published
- 2026-06-04: disclosed: CVE-2026-41234 published to NVD