DNS Injection Risk in Froxlor Server Administration Software

CVE-2026-41230

What is CVE-2026-41230?

Froxlor, an open-source server administration tool, prior to version 2.3.6, has a vulnerability that allows authenticated users to inject unauthorized DNS records into their zone files. The issue arises from the DomainZones::add() function, which accepts various DNS record types without proper validation. Malicious users can take advantage of the lack of a whitelist for DNS types and the failure to sanitize newline characters in the content field. As a result, they can add arbitrary DNS records and BIND directives, potentially compromising the DNS configuration of affected domains. Version 2.3.6 addresses this security flaw.

References