Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2026-30932: 0.56% estimated exploitation activity in the next 30 days; percentile 46.99 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. Affected Code lib/Froxlor/Api/Commands/DomainZones.php, lines 213-214, 253-254, 290-291, 292-293: There is even a TODO comment at line 148 acknowledging this gap: The content is then written directly into the BIND zone file via DnsEntry::toString() (line 83 of lib/Froxlor/Dns/DnsEntry.php): And the zone file is written to disk in lib/Froxlor/Cron/Dns/Bind.php line 121: PoC As a customer with DNS management enabled and an API key, add a LOC record with injected BIND directives: Alternatively via the web UI, intercept the DNS editor form POST and set dnscontent to 0 0 0 N 0 0 0 E 0\n$INCLUDE /etc/passwd and dnstype to LOC. After the DNS rebuild cron runs, the…

Published by the source

24 Mar 2026, 16:49 UTC

Last modified by the source

30 Mar 2026, 13:50 UTC

Source last checked

26 Oct 2026, 14:39 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-x6w6-2xwp-3jh6

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-30932

Advisory: Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
IDs: CVE-2026-30932, GHSA-x6w6-2xwp-3jh6
Record: https://patchnext.com/advisories/cve-2026-30932 (revision 1, source checked 26 Oct 2026, 14:39 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: froxlor/froxlor 2.3.5. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist froxlor/froxlor: affected <= 2.3.4; fixed in 2.3.5

## Suggested inspection (read-only)
- Packagist froxlor/froxlor: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on froxlor/froxlor.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-x6w6-2xwp-3jh6 (GitHub-reviewed advisory GHSA-x6w6-2xwp-3jh6 lists affected ranges: Packagist froxlor/froxlor >=0 <=2.3.4)

Commands are suggestions: review each one before running it.