CVE-2026-54543

MediumCVSS 5.4

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

Froxlor before version 2.3.8 has a vulnerability in the DomainZones.add API command that does not reject line delimiters, tab characters, semicolons, or unsupported DNS record types before serializing values into a BIND zone file. An authenticated customer with DNS-zone permissions can inject additional resource-record lines, bypassing field-level validation. BIND accepts the injected records, allowing modification of DNS data and potential DNS availability impact.

Risk Assessment

An attacker can modify DNS records in an authorized zone, potentially leading to traffic redirection, service disruption, or other DNS-related damage.

Recommendation

Upgrade Froxlor to version 2.3.8 or later, which includes the fix.

Original NVD description (English source)

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.