TI-2026-29843 Aliases CVE-2026-41234 GHSA-37m5-m4q3-fc6x

Froxlor: BIND Zone File Injection via TXT Record Content

HIGH 66CWE-74Published 2026-06-04 · Updated 2026-06-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives (`$INCLUDE`, `$GENERATE`) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron. This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records. Version 2.3.7 contains an updated patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0027 19th percentileScored 2026-11-07

Fix Fixed froxlor (froxlor): 2.3.7froxlor/froxlor (Packagist): 2.3.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
froxlor	froxlor	before 2.3.7	2.3.7	Patch available	CNA
—	froxlor/froxlor (Packagist)	before 2.3.7	2.3.7	Patch available	GHSA-37m5-m4q3-fc6x

froxlor Vendorfroxlor Affected before 2.3.7 Fixed in 2.3.7 Patch available CNA
froxlor/froxlor (Packagist) Vendor— Affected before 2.3.7 Fixed in 2.3.7 Patch available GHSA-37m5-m4q3-fc6x

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:froxlor:froxlor::::::::	—	—	froxlor

cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:* Versions — — ·froxlor

Remediation

Fix · CNA froxlor (froxlor) Fixed in 2.3.7
Fix · GHSA-37m5-m4q3-fc6x froxlor/froxlor (Packagist) Fixed in 2.3.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41234
2026-10-03 Alias added: GHSA-37m5-m4q3-fc6x

References

Advisory 2

Other 3

TI-2023-00300 Command Injection in froxlor/froxlor CVSS 3.1HIGH 8.8
TI-2023-02973 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor CVSS 3.1CRITICAL 9.8
TI-2023-01234 Authentication Bypass by Primary Weakness in froxlor/froxlor CVSS 3.1CRITICAL 9.8
TI-2023-01911 Unrestricted Upload of File with Dangerous Type in froxlor/froxlor CVSS 3.1HIGH 8.8
TI-2026-64867 froxlor before 2.3.12 Authentication Bypass via Session Persistence CVSS 4.0HIGH 8.7
TI-2026-76945 Symlink following in Froxlor enables root privilege escalation CVSS 4.0CRITICAL 9.4

See all 86 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences