CVE-2026-54347: Froxlor stored XSS in DNS editor via TXT records

CVE-2026-54347 · Severity: high · CVSS 8.7 · Published 2026-08-18

Froxlor is a hosting management control panel used by ISPs to manage multiple customer domains and DNS records. A stored cross-site scripting (XSS) vulnerability in the DNS editor allows a customer with basic DNS editing privileges to inject malicious code that executes in administrators' browsers when they view DNS settings. An attacker could exploit this to steal admin session cookies, create backdoor administrator accounts, access all customer data, or compromise the entire hosting server.

Technologies: Froxlor, froxlor/froxlor (Packagist). Vendors: Froxlor, Packagist.

Quick answers

Is CVE-2026-54347 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54347 being exploited in the wild.
How severe is CVE-2026-54347?
High severity, with a CVSS score of 8.7, published 18 August 2026.
Which products and versions are affected?
Froxlor <= 2.3.7; froxlor/froxlor (Packagist) <= 2.3.7, ECOSYSTEM:introduced=0,fixed=2.3.8.
Is there a fix for CVE-2026-54347?
Yes. froxlor/froxlor (Packagist): upgrade to 2.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54347 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-54347?
Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • froxlor/froxlor (Packagist): upgrade to 2.3.8 or later
    composer require froxlor/froxlor:^2.3.8

Technical details

The vulnerability stems from three converging failures: (1) Input validation at `DomainZones.php:158` only strips non-printable characters but leaves HTML special characters like &lt; and &gt; intact; (2) the display callback at `Text.php:95` returns wordwrapped text without HTML escaping; (3) the Twig template at `table.html.twig:57` renders the callback output with the `|raw` filter, bypassing auto-escaping. An attacker with DNS editor privileges (typically customer-level access) can inject a payload like `&lt;img src=x onerror=alert(document.domain)&gt;` into any TXT record. The payload executes automatically when any logged-in administrator navigates to the domain's DNS editor page—no user interaction beyond page navigation is required. The CSP header includes `'unsafe-inline'` and `'unsafe-eval'`, rendering it ineffective as a mitigation. A real exploit would exfiltrate admin session cookies to create backdoor accounts or execute arbitrary commands through Froxlor's system interface.

Affected products

  • Froxlor Froxlor <= 2.3.7

Identifiers

  • CVE-2026-54347
  • GHSA-43gm-9rr3-cx7g

Timeline

  • 2026-08-18: disclosed: GitHub Security Advisory published
  • 2026-08-18: patched: Fix released in version 2.3.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.