CVE-2026-54543: Froxlor DomainZones.add DNS zone-file injection

CVE-2026-54543 · Severity: medium · CVSS 5.4 · Published 2026-08-18

Froxlor is a web hosting control panel that manages DNS zones for customer domains. An authenticated customer can inject malicious DNS records into zones they should only be able to manage through crafted API calls, bypassing validation controls. This allows an attacker to modify DNS zone integrity, redirect domain traffic, or degrade DNS service for domains under their control, causing business and customer impact.

Technologies: Froxlor, froxlor/froxlor (Packagist). Vendors: Froxlor, Packagist.

Quick answers

Is CVE-2026-54543 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54543 being exploited in the wild.
How severe is CVE-2026-54543?
Medium severity, with a CVSS score of 5.4, published 18 August 2026.
Which products and versions are affected?
Froxlor <= 2.3.7; froxlor/froxlor (Packagist) <= 2.3.7, ECOSYSTEM:introduced=0,fixed=2.3.8.
Is there a fix for CVE-2026-54543?
Yes. froxlor/froxlor (Packagist): upgrade to 2.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54543 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-54543?
Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • froxlor/froxlor (Packagist): upgrade to 2.3.8 or later
    composer require froxlor/froxlor:^2.3.8

Technical details

Froxlor DomainZones.add API command performs insufficient input validation on the DNS record name and record type fields. The vulnerability exists in lib/Froxlor/Api/Commands/DomainZones.php where record and type parameters are trimmed, lowercased, and IDNA-encoded but do not reject control characters, tabs, newlines, or semicolon delimiters. These unsanitized values are later written to BIND zone files by DnsEntry::__toString(), allowing an attacker to inject additional DNS resource records. For example, submitting record="www\t60\tIN\tA\t6.6.6.6 ;\n@" causes BIND to parse two separate A records instead of one. The attack requires prior authentication with DNS-zone management permissions on the domain, but no additional user interaction. BIND silently accepts the malformed zone file and processes injected records as legitimate. Patch version 2.3.8 is available.

Affected products

  • Froxlor Froxlor <= 2.3.7

Identifiers

  • CVE-2026-54543
  • GHSA-5rw4-4665-cvwf

Timeline

  • 2026-06-29: disclosed
  • 2026-06-29: patched: Patch version 2.3.8 released
  • 2026-08-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.