Most recent entries from all

EUVD-2026-324687

fkie_cve-2026-41234

Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives (`$INCLUDE`, `$GENERATE`) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron. This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records. Version 2.3.7 contains an updated patch.

GHSA-37m5-m4q3-fc6x — Froxlor: BIND Zone File Injection via TXT Record Content

Affected: Packagist: froxlor/froxlor

## Summary

The `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives (`$INCLUDE`, `$GENERATE`) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron.

This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records.

## Affected Code

`lib/Froxlor/Api/Commands/DomainZones.php`, lines 306-308:

```php } elseif ($type == 'TXT' && !empty($content)) { // check that TXT content is enclosed in " " $content = Dns::encloseTXTContent($content); } ```

`Dns::encloseTXTContent()` (`lib/Froxlor/Dns/Dns.php:571-592`) only adds or removes surrounding quote characters. It does not strip newlines, carriage returns, or any BIND zone metacharacters.

Line 148 of `DomainZones.php` still contains: ```php // TODO regex validate content for invalid characters ```

The content flows to the zone file via `DnsEntry::__toString()` (`lib/Froxlor/Dns/DnsEntry.php:83`), which concatenates `$this->content` directly into the zone line followed by `PHP_EOL`. Embedded newlines in the content produce additional lines in the zone file output.

### Comparison with CVE-2026-30932 fix

The v2.3.5…

WID-SEC-W-2026-1782 — Froxlor: Schwachstelle ermöglicht Manipulation, Offenlegung und DoS

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Froxlor ausnutzen, um Daten zu manipulieren, Informationen offenzulegen oder einen Denial of Servcie zu verursachen.