QSearchQSearch

CVE-2026-41234

7.6 HIGH

Froxlor is open source server administration software

Published: 2026-06-04 · Last updated: 2026-06-05

Severity and scoring

CVSS
7.6 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CWE
CWE-74

Description

Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives (`$INCLUDE`, `$GENERATE`) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron. This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records. Version 2.3.7 contains an updated patch.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-47162 — Vim is an open source, command line text editor
  • CVE-2026-11859 — An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation...
  • CVE-2026-46546 — Frappe Learning Management System (LMS) is a learning system that helps users structure their content
  • CVE-2026-47634 — Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized ... (7.3 HIGH)
  • CVE-2026-42835 — Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows ... (8.1 HIGH)