CVE-2026-41234 Details
Description
Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives (`$INCLUDE`, `$GENERATE`) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron. This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records. Version 2.3.7 contains an updated patch.
A vulnerability exists in Froxlor versions prior to 2.3.7, specifically within the 'DomainZones.add' API endpoint. This issue arises because the endpoint fails to properly sanitize newline characters in TXT record values. An authenticated customer with DNS editing privileges can exploit this by injecting newlines, causing the text to break out of its intended format in the generated BIND zone file. As a result, arbitrary BIND directives, such as '$INCLUDE' and '$GENERATE', along with various DNS records (A, MX, CNAME), can be injected into the zone file that is written to disk during the DNS rebuild cron job. This vulnerability is an incomplete fix for CVE-2026-30932, which addressed similar newline injection issues for other record types but overlooked TXT records.
Users can update to Froxlor version 2.3.7, which includes a patch that sanitizes TXT record content by removing invalid control characters and adding proper validation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-37m5-m4q3-fc6x | CISA-ADP | AdvisoryBundleExploitRemedyTechnical AnalysisVendor |
| https://github.com/advisories/GHSA-x6w6-2xwp-3jh6 | [email protected] | AdvisoryBundle |
| https://github.com/froxlor/froxlor/releases/tag/2.3.7 | [email protected] | Release NotesVendor |
| https://github.com/froxlor/froxlor/security/advisories/GHSA-37m5-m4q3-fc6x | [email protected] | AdvisoryBundleExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Froxlor | <= 2.3.6 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |