EUVD-2026-277339

fkie_cve-2026-30932

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

GHSA-x6w6-2xwp-3jh6 — Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Affected: Packagist: froxlor/froxlor

## Summary

The `DomainZones.add` API endpoint (accessible to customers with DNS enabled) does not validate the `content` field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. `$INCLUDE`) into the zone file that gets written to disk when the DNS rebuild cron job runs.

## Affected Code

`lib/Froxlor/Api/Commands/DomainZones.php`, lines 213-214, 253-254, 290-291, 292-293:

```php } elseif ($type == 'LOC' && !empty($content)) { $content = $content; // no validation } ... } elseif ($type == 'RP' && !empty($content)) { $content = $content; // no validation } ... } elseif ($type == 'SSHFP' && !empty($content)) { $content = $content; // no validation } elseif ($type == 'TLSA' && !empty($content)) { $content = $content; // no validation } ```

There is even a TODO comment at line 148 acknowledging this gap: ```php // TODO regex validate content for invalid characters ```

The content is then written directly into the BIND zone file via `DnsEntry::__toString()` (line 83 of `lib/Froxlor/Dns/DnsEntry.php`):

```php return $this->record . "\t" . $this->ttl . "\t" . $this->class . "\t" . $this->type . "\t" ... . $_content . PHP_EOL; ```

And the zone file is written to disk in `lib/Froxlor/Cron/Dns/Bind.php` line 121:

```php fwrite($zonefile_handler, $zoneContent . $subzones); ```

## PoC

As a customer with DNS management enabled and an API key, add a LOC record with injected BIND directives:

```…

WID-SEC-W-2026-0834 — Froxlor: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von Informationen

Ein Angreifer kann eine Schwachstelle in Froxlor ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.

Most recent entries from all

EUVD-2026-277339

fkie_cve-2026-30932

GHSA-x6w6-2xwp-3jh6 — Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

WID-SEC-W-2026-0834 — Froxlor: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von Informationen