CVE-2026-41230 Details
Description
Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g., `NAPTR`, `PTR`, `HINFO`), content validation is entirely bypassed. Embedded newline characters in the content survive `trim()` processing, are stored in the database, and are written directly into BIND zone files via `DnsEntry::__toString()`. An authenticated customer can inject arbitrary DNS records and BIND directives (`$INCLUDE`, `$ORIGIN`, `$GENERATE`) into their domain's zone file. Version 2.3.6 fixes the issue.
A vulnerability in Froxlor prior to version 2.3.6 allows authenticated customers to inject arbitrary DNS records and BIND directives into their domain's zone file. The issue arises because the 'DomainZones::add()' function accepts various DNS record types without proper validation and fails to sanitize newline characters in the 'content' field. As a result, when unsupported DNS types like 'NAPTR' are submitted, the content bypasses validation entirely. Newline characters remain after trimming, are stored in the database, and directly written into BIND zone files, where they can be interpreted as separate resource records or directives.
Users should update to Froxlor version 2.3.6, which addresses this vulnerability by adding proper validation for DNS record types and sanitizing newline characters in the content field.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-47hf-23pw-3m8c | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/froxlor/froxlor/commit/47a8af5d9523cb6ec94567405cfc2e294d3a1442 | [email protected] | Patch |
| https://github.com/froxlor/froxlor/releases/tag/2.3.6 | [email protected] | Release Notes |
| https://github.com/froxlor/froxlor/security/advisories/GHSA-47hf-23pw-3m8c | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| froxlor froxlor | < 2.3.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | New CVE Received | [email protected] |