{"id":"CVE-2026-54543","aliases":["EUVD-2026-61217","GHSA-5rw4-4665-cvwf"],"status":"published","title":"Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields","description":"Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00447,"percentile":0.39166,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-74"],"published":"2026-08-18T20:12:12Z","modified":"2026-11-09T20:10:00Z","fixes":[{"ecosystem":"Packagist","package":"froxlor/froxlor","fixed_in":["2.3.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"froxlor/froxlor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.7"},{"fixed":"2.3.8"}]}]},{"source":"osv","ecosystem":"Packagist","package":"froxlor/froxlor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8"}]}],"versions":["0.10.0","0.10.0-rc1","0.10.0-rc2","0.10.1","0.10.10","0.10.11","0.10.12","0.10.13","0.10.14","0.10.15","0.10.16","0.10.17","0.10.18","0.10.19","0.10.2","0.10.20","0.10.21","0.10.22","0.10.23","0.10.23.1","0.10.24","0.10.25","0.10.26","0.10.27","0.10.28","0.10.29","0.10.29.1","0.10.3","0.10.30","0.10.31","0.10.32","0.10.33","0.10.34","0.10.34.1","0.10.35","0.10.35.1","0.10.36","0.10.37","0.10.38","0.10.38.1","0.10.38.2","0.10.38.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-beta1","2.1.0-beta2","2.1.0-rc1","2.1.0-rc2","2.1.0-rc3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-rc1","2.2.0-rc2","2.2.0-rc3","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7"]}],"products":[{"vendor":"froxlor","product":"froxlor"}],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.8","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-5rw4-4665-cvwf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54543.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54543","tags":["advisory"]},{"url":"https://github.com/froxlor/froxlor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54543","title":"Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields","description":"Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.","status":"published","published":"2026-08-18T20:12:12.161Z","modified":"2026-08-19T13:14:03.622Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-61217","description":"Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.","status":"published","published":"2026-08-18T20:12:12Z","modified":"2026-08-19T13:14:03Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:45.260244Z"}],"ghsa":[{"id":"GHSA-5rw4-4665-cvwf","title":"Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields","description":"Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.\n\nThe stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:\n\nwww\\t60\\tIN\\tA\\t6.6.6.6 ;\\n@\n\nwith type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\\Dns\\DnsEntry::__toString() sink renders it as:\n\nwww    60    in    a    6.6.6.6 ;\n@      18000 IN    A    127.0.0.1\n\nBIND accepts the generated zone file:\n\nnamed-checkzone example.com froxlor_dns_record_injected.zone\nzone example.com/IN: loaded serial 2026060501\nOK\n\nnamed-compilezone -D confirms both records are parsed as real DNS RRs:\n\nexample.com.       18000 IN A 127.0.0.1\nwww.example.com.      60 IN A 6.6.6.6\nzone example.com/IN: loaded serial 2026060501\nOK\n\nAffected code in 2.3.7:\n- lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params.\n- lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection.\n- lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only.\n- lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domain_dns_entries.\n- lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry.\n- lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.\n\nThere is also a related type-field variant because type is not allowlisted and domain_dns_entries.type is varchar(10). The value NS\\tns.\\n@\\tA renders one submitted entry as multiple zone-file records.\n\nImpact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.\n\nSuggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.\n\nAttribution: Yaohui Wang.","status":"published","published":"2026-08-18T20:48:04Z","modified":"2026-08-18T20:48:05Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:41:03.602876Z"}],"nvd":[{"id":"CVE-2026-54543","description":"Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.","status":"published","published":"2026-08-18T21:16:36.313Z","modified":"2026-11-09T20:10:00.2Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-09T22:15:51.558963Z"}],"osv":[{"id":"CVE-2026-54543","title":"Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields","description":"Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.","status":"published","published":"2026-08-18T20:12:12.161Z","modified":"2026-11-11T02:31:07.473236824Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-11T11:06:48.457425Z"},{"id":"GHSA-5rw4-4665-cvwf","title":"Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields","description":"Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.\n\nThe stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:\n\nwww\\t60\\tIN\\tA\\t6.6.6.6 ;\\n@\n\nwith type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\\Dns\\DnsEntry::__toString() sink renders it as:\n\nwww    60    in    a    6.6.6.6 ;\n@      18000 IN    A    127.0.0.1\n\nBIND accepts the generated zone file:\n\nnamed-checkzone example.com froxlor_dns_record_injected.zone\nzone example.com/IN: loaded serial 2026060501\nOK\n\nnamed-compilezone -D confirms both records are parsed as real DNS RRs:\n\nexample.com.       18000 IN A 127.0.0.1\nwww.example.com.      60 IN A 6.6.6.6\nzone example.com/IN: loaded serial 2026060501\nOK\n\nAffected code in 2.3.7:\n- lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params.\n- lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection.\n- lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only.\n- lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domain_dns_entries.\n- lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry.\n- lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.\n\nThere is also a related type-field variant because type is not allowlisted and domain_dns_entries.type is varchar(10). The value NS\\tns.\\n@\\tA renders one submitted entry as multiple zone-file records.\n\nImpact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.\n\nSuggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.\n\nAttribution: Yaohui Wang.","status":"published","published":"2026-08-18T20:48:04Z","modified":"2026-08-18T21:11:08.088435Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}