CVE-2026-54543: Froxlor DNS Zone-File RR Injection Vulnerability
Summary
CVE-2026-54543: Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields. Affects froxlor/froxlor versions < 2.3.8. Fixed in 2.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Froxlor is an open-source server management panel that allows users to manage their web hosting services, including DNS management. It provides a user-friendly interface for managing domains, databases, and other server resources. The vulnerability in question arises from the DomainZones.add API command, which fails to properly validate user input for DNS records, leading to potential security risks.
Vulnerability Detail
The vulnerability allows authenticated users with DNS-zone permissions to inject arbitrary DNS records into generated BIND zone files. This occurs because the DomainZones.add API command does not adequately reject control characters, line delimiters, or comment delimiters in the record and type fields. As a result, an attacker can manipulate DNS entries, potentially leading to DNS zone integrity loss and availability issues. The vulnerability is present in version 2.3.7 of Froxlor, where the affected code fails to sanitize inputs properly, allowing for the injection of malicious records.
How To Fix
Minimum fixed version
2.3.8
This is the first release that contains the fix.
composer require froxlor/froxlor:2.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the DNS record and type fields to reject control characters, line breaks, and semicolons. This can be done by modifying the API command to include checks that ensure only valid DNS record formats are accepted.
Conclusion
CVE-2026-54543 is a significant vulnerability in the Froxlor package that allows for DNS zone-file resource record injection due to insufficient input validation. Users are advised to update to version 2.3.8 or later to mitigate this risk. Implementing additional input validation can also serve as a temporary workaround.
See every vulnerability recorded for froxlor/froxlor →
FAQ
CVE-2026-54543 is a vulnerability in the Froxlor package that allows for DNS zone-file resource record injection due to improper input validation.
Authenticated users with DNS-zone permissions in Froxlor versions prior to 2.3.8 are affected by this vulnerability.
The vulnerability can lead to unauthorized DNS record injection, resulting in DNS zone integrity loss and possible service disruptions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for froxlor/froxlor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
