Is CVE-2026-41234 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41234 being exploited in the wild.

How severe is CVE-2026-41234?

High severity, with a CVSS score of 7.6, published 4 June 2026.

Which products and versions are affected?

Froxlor < 2.3.7, <= 2.3.6; froxlor/froxlor (Packagist) <= 2.3.6, ECOSYSTEM:introduced=0,fixed=2.3.7.

Is there a fix for CVE-2026-41234?

Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41234 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41234?

Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41234: Froxlor BIND zone file injection in DomainZones API TXT records

Q: Which products and versions are affected?

Froxlor < 2.3.7, <= 2.3.6; froxlor/froxlor (Packagist) <= 2.3.6, ECOSYSTEM:introduced=0,fixed=2.3.7.

Q: Is there a fix for CVE-2026-41234?

Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41234 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-41234?

Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41234 · Severity: high · CVSS 7.6 · Published 2026-06-04

Froxlor is an open-source server management panel used to administer web hosting environments. A security flaw allows authorized customers with DNS management permissions to inject malicious commands into the server's DNS configuration files. This could allow an attacker to redirect web traffic, intercept emails, or view sensitive system files on the hosting server, potentially leading to a full compromise of the DNS service for their domains.

Technologies: Froxlor, froxlor/froxlor (Packagist). Vendors: Froxlor, Packagist.

Quick answers

Is CVE-2026-41234 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41234 being exploited in the wild.
How severe is CVE-2026-41234?: High severity, with a CVSS score of 7.6, published 4 June 2026.
Which products and versions are affected?: Froxlor < 2.3.7, <= 2.3.6; froxlor/froxlor (Packagist) <= 2.3.6, ECOSYSTEM:introduced=0,fixed=2.3.7.
Is there a fix for CVE-2026-41234?: Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41234 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41234?: Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

froxlor/froxlor (Packagist): upgrade to 2.3.7 or later
```
composer require froxlor/froxlor:^2.3.7
```

Technical details

The `DomainZones.add` API endpoint fails to sanitize newline characters in the `content` field when the record type is set to `TXT`. This is an incomplete fix for a previous vulnerability (CVE-2026-30932) which addressed other record types but omitted TXT. An authenticated attacker with DNS editing privileges can use newline characters (`\n`) to break out of the TXT record context in the generated BIND zone file. This allows the injection of arbitrary BIND directives such as `$INCLUDE` (to read local files like `/etc/passwd`) or `$GENERATE`, as well as the creation of unauthorized A, MX, or CNAME records. The vulnerability is exploited when the DNS rebuild cron job writes the unsanitized content to disk. The issue is resolved in version 2.3.7.

Affected products

Froxlor Froxlor < 2.3.7

Identifiers

CVE-2026-41234
GHSA-37m5-m4q3-fc6x

Timeline

2026-05-15: patched: Version 2.3.7 released
2026-06-03: advisory: GitHub Security Advisory GHSA-37m5-m4q3-fc6x published
2026-06-04: disclosed: CVE-2026-41234 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.