CVE-2026-30932CWE-74

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

High · published March 24, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
52.8
In the wild
Unconfirmed
What it is

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00705 · 52.8th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-03-24T18:46Z
EPSS history
Timeline
  • 24 MAR 18:46Z
    Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
    cvelistv5