# CVE-2026-41237: Froxlor DNS zone file injection via improper record validation

Source: https://junglewise.ai/threats/cve-2026-41237-froxlor-dns-zone-file-injection-via-improper-record-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-41237 · Severity: medium · CVSS 4 · Published 2026-06-04

Froxlor is an open-source server management panel used to administer web hosting environments, including DNS settings. A vulnerability in how the software handles DNS record entries allows an attacker with limited privileges to inject malicious data into the server's DNS configuration files. This could lead to the creation of unauthorized DNS records, potentially allowing an attacker to redirect web traffic or intercept communications.

Technologies: [Froxlor](https://junglewise.ai/threats/technologies/froxlor), [froxlor/froxlor (Packagist)](https://junglewise.ai/threats/technologies/froxlor-froxlor). Vendors: [Froxlor](https://junglewise.ai/threats/vendors/froxlor), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-41237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41237 being exploited in the wild.

**How severe is CVE-2026-41237?** Medium severity, with a CVSS score of 4, published 4 June 2026.

**Which products and versions are affected?** Froxlor <= 2.3.6; froxlor/froxlor (Packagist) <= 2.3.6, ECOSYSTEM:introduced=0,fixed=2.3.7.

**Is there a fix for CVE-2026-41237?** Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41237 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41237?** Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- froxlor/froxlor (Packagist): upgrade to 2.3.7 or later

  ```sh
  composer require froxlor/froxlor:^2.3.7
  ```


## Technical details

Froxlor versions up to 2.3.6 are vulnerable to DNS zone file injection due to improper neutralization of special elements (CWE-74). The software concatenates DNS record content directly into Bind9 zone files. While a patch was introduced to validate LOC, RP, SSHFP, and TLSA records, it was incomplete. Specifically, the regular expression for LOC records uses '\s+', which in PHP's PCRE engine matches newlines, allowing an attacker to embed newlines within a record to inject arbitrary DNS entries. Additionally, TLSA records with 'matchingType=0' lack an upper bound on hex data length, and the validators fail to perform proper zone-file escaping on raw input. An authenticated user with permission to manage DNS records can exploit this to corrupt zone files or redirect traffic. The issue is addressed in version 2.3.7.

## Affected products

- Froxlor Froxlor <= 2.3.6

## Identifiers

- CVE-2026-41237
- GHSA-j6fm-9rfm-j5hx

## Timeline

- 2026-02-24: patched: Initial fix commit b34829262dc3
- 2026-05-15: advisory: Release of version 2.3.7
- 2026-06-04: disclosed: CVE-2026-41237 published

## References

- [https://github.com/froxlor/froxlor/commit/b34829262dc3](https://github.com/froxlor/froxlor/commit/b34829262dc3)
- [https://github.com/froxlor/froxlor/releases/tag/2.3.7](https://github.com/froxlor/froxlor/releases/tag/2.3.7)
- [https://github.com/froxlor/froxlor/security/advisories/GHSA-j6fm-9rfm-j5hx](https://github.com/froxlor/froxlor/security/advisories/GHSA-j6fm-9rfm-j5hx)

## Related threats

- [Froxlor information disclosure in API keys listing](https://junglewise.ai/threats/cve-2026-121436-froxlor-from-2-3-8-before-2-3-15-contains-an-information)
- [Froxlor authorization bypass in Mysqls.add API](https://junglewise.ai/threats/cve-2026-121435-froxlor-before-2-3-15-contains-an-authorization-bypass)
- [Froxlor Certificates API authorization bypass in Let's Encrypt management](https://junglewise.ai/threats/cve-2026-121434-froxlor-2-3-0-before-2-3-15-contains-a-missing-authorization)
- [Froxlor symlink following in Statistics::makeChownWithNewStats](https://junglewise.ai/threats/cve-2026-113678-froxlor-before-2-3-15-contains-a-symlink-following-vulnerability)
- [Froxlor missing authorization in SubDomains.delete API](https://junglewise.ai/threats/cve-2026-113677-froxlor-from-0-10-0-before-2-3-15-contains-a-missing)