CVE-2026-54543

MEDIUM 5.4

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.

CWE	CWE-74
Vendor	froxlor
Product	froxlor
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for froxlor froxlor

Be the first to know when new medium vulnerabilities affecting froxlor froxlor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

froxlor / froxlor

< 2.3.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf github.com: https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a github.com: https://github.com/froxlor/froxlor/releases/tag/2.3.8