https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T04:58:44.833168+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277339 EUVD-2026-277339 2026-10-10T04:58:44.835554+00:00 EUVD-2026-277339 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30932 fkie_cve-2026-30932 2026-10-10T04:58:44.835585+00:00

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

 https://cve.radiocsirt.org/vuln/ghsa-x6w6-2xwp-3jh6 GHSA-x6w6-2xwp-3jh6 — Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API 2026-10-10T04:58:44.835617+00:00

Affected: Packagist: froxlor/froxlor

## Summary

The `DomainZones.add` API endpoint (accessible to customers with DNS enabled) does not validate the `content` field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. `$INCLUDE`) into the zone file that gets written to disk when the DNS rebuild cron job runs.

## Affected Code

`lib/Froxlor/Api/Commands/DomainZones.php`, lines 213-214, 253-254, 290-291, 292-293:

```php } elseif ($type == 'LOC' && !empty($content)) { $content = $content; // no validation } ... } elseif ($type == 'RP' && !empty($content)) { $content = $content; // no validation } ... } elseif ($type == 'SSHFP' && !empty($content)) { $content = $content; // no validation } elseif ($type == 'TLSA' && !empty($content)) { $content = $content; // no validation } ```

There is even a TODO comment at line 148 acknowledging this gap: ```php // TODO regex validate content for invalid characters ```

The content is then written directly into the BIND zone file via `DnsEntry::__toString()` (line 83 of `lib/Froxlor/Dns/DnsEntry.php`):

```php return $this->record . "\t" . $this->ttl . "\t" . $this->class . "\t" . $this->type . "\t" ... . $_content . PHP_EOL; ```

And the zone file is written to disk in `lib/Froxlor/Cron/Dns/Bind.php` line 121:

```php fwrite($zonefile_handler, $zoneContent . $subzones); ```

## PoC

As a customer with DNS management enabled and an API key, add a LOC record with injected BIND directives:

```…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0834 WID-SEC-W-2026-0834 — Froxlor: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von Informationen 2026-10-10T04:58:44.835670+00:00

Ein Angreifer kann eine Schwachstelle in Froxlor ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.