EUVD-2026-325202

fkie_cve-2026-41237

Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators return raw input without zone-file escaping. Version 2.3.7 contains an updated patch.

GHSA-j6fm-9rfm-j5hx — Froxlor has an incomplete fix for CVE-2026-30932

Affected: Packagist: froxlor/froxlor

### Summary

The LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators return raw input without zone-file escaping.

### Affected Package

- **Ecosystem:** Other - **Package:** froxlor - **Affected versions:** all versions before fix commit b34829262dc3 - **Patched versions:** >= commit b34829262dc3

### Severity

Medium -- CVSS

### CWE

CWE-74 -- Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

### Details

DNS record content is concatenated directly into bind9 zone files at `DnsEntry.php` line 83. Before the fix, LOC/RP/SSHFP/TLSA records had no content validation at all, enabling zone file injection via embedded newlines.

The fix adds format-specific regexes and field validation but has gaps: the LOC regex's `\s+` matches newlines in PHP's PCRE engine, allowing a LOC record with a newline between fields to pass validation but produce multiple lines in the zone file. TLSA `matchingType=0` only requires `len(data) >= 2` with no upper bound, enabling arbitrarily large payloads. All validators return raw input without zone-file escaping.

### PoC

```python #!/usr/bin/env python3 """ CVE-2026-30932 - Incomplete DNS Record Content Validation in froxlor/froxlor

Affected component: lib/Froxlor/Api/Commands/DomainZones.php Vulnerability type: Input Validation / DNS Zone File Injection Patch: https://github.com/froxl…

WID-SEC-W-2026-1737 — Froxlor: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.

Most recent entries from all

EUVD-2026-325202

fkie_cve-2026-41237

GHSA-j6fm-9rfm-j5hx — Froxlor has an incomplete fix for CVE-2026-30932

WID-SEC-W-2026-1737 — Froxlor: Mehrere Schwachstellen