Read the docs
TI-2026-23757 Aliases CVE-2026-30932GHSA-x6w6-2xwp-3jh6

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Priority HIGH 70CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00565 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed froxlor (froxlor): 2.3.5froxlor/froxlor (Packagist): 2.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
froxlorfroxlorbefore 2.3.52.3.5Patch availableCNA
—froxlor/froxlor (Packagist)before 2.3.52.3.5Patch availableGHSA-x6w6-2xwp-3jh6
  • froxlor Vendorfroxlor Affected before 2.3.5 Fixed in 2.3.5 Patch available CNA
  • froxlor/froxlor (Packagist) Vendor— Affected before 2.3.5 Fixed in 2.3.5 Patch available GHSA-x6w6-2xwp-3jh6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*before 2.3.5Vulnerablefroxlor
  • cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:* Versions before 2.3.5 Vulnerable ·froxlor

Remediation

  • Fix · CNA froxlor (froxlor) Fixed in 2.3.5
  • Fix · GHSA-x6w6-2xwp-3jh6 froxlor/froxlor (Packagist) Fixed in 2.3.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30932
  2. 2026-10-03 Alias added: GHSA-x6w6-2xwp-3jh6
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-00300 Command Injection in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2023-02973 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01234 Authentication Bypass by Primary Weakness in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01911 Unrestricted Upload of File with Dangerous Type in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2026-29837 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-29838 Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) CVSS 3.1CRITICAL 9.1
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences