CVE-2026-41234 is a high-severity security vulnerability in froxlor/froxlor (composer), affecting versions <= 2.3.6. It is fixed in 2.3.7.
Summary The DomainZones.add API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives ($INCLUDE, $GENERATE) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron. This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records. Affected Code lib/Froxlor/Api/Commands/DomainZones.php, lines 306-308: Dns::encloseTXTContent() (lib/Froxlor/Dns/Dns.php:571-592) only adds or removes surrounding quote characters. It does not strip newlines, carriage returns, or any BIND zone metacharacters. Line 148 of DomainZones.php still contains: The content flows to the zone file via DnsEntry::_toString() (lib/Froxlor/Dns/DnsEntry.php:83), which concatenates $this->content directly into the zone line followed by PHPEOL. Embedded newlines in the content produce additional lines in the zone file output. Comparison with CVE-2026-30932 fix The v2.3.5 fix for CVE-2026-30932 added validation functions for these types: | Type | Validation Added | Still Vulnerable? | |------|-----------------|-------------------| | LOC | Validate::validateDnsLoc() (strict regex) | No | | RP | Validate::validateDnsRp() (domain validation) | No | | SSHFP | Validate::validateDnsSshfp() (3-part split) | No | | TLSA | Validate::validateDnsTlsa() (4-part split) | No | | TXT | Dns::encloseTXTContent() (quotes only) | Yes | PoC Environment Froxlor 2.3.5, clean Docker install (Debian Bookworm, PHP 8.2, Apache 2.4) DNS enabled (system.bindenable=1, system.dnsenabled=1) Customer with dnsenabled=1, domain with isbinddomain=1 Customer has an API key (or uses the web UI DNS editor with Burp) Reproduction via API Reproduction via Web UI (Burp) Log in as a customer with DNS editing enabled Navigate to Resources > Domains > (domain) > DNS Editor Add a new record: Type = TXT, Record = @, Content = any Intercept the POST request in Burp Suite Change the dnscontent parameter to: v=spf1 +all"%0a$INCLUDE /etc/passwd (%0a is URL-encoded newline) Forward the request Result The API returns the generated zone content. The TXT record line is split at the newline, and $INCLUDE /etc/passwd appears on its own line as a BIND directive: When the DNS rebuild cron runs, BIND processes the $INCLUDE directive and attempts to read /etc/passwd. Variant: Arbitrary DNS record injection The same technique injects arbitrary A/MX/CNAME records: Result: evil.testdomain.lab now resolves to attacker IP 6.6.6.6. Automated PoC Script Usage: python3 poc.py https://panel.example.com APIKEY APISECRET domain.tld Impact Information Disclosure: $INCLUDE directs BIND to read arbitrary world-readable files on the server. The included content is parsed as zone data and can be retrieved by the customer via DomainZones.listing or DNS queries to records created from parsed file lines. DNS Record Injection: Newline breakout allows injection of A, MX, CNAME, and other records into the zone file. A customer can point subdomains to attacker-controlled IPs, intercept email via MX injection, or perform subdomain takeover via CNAME injection. DNS Service Disruption: Malformed zone content causes BIND to reject the zone, creating a DNS outage for the affected domain. $GENERATE directives can create massive record sets for amplification. Suggested Fix Strip newlines and BIND metacharacters from TXT content. Minimal fix: A more comprehensive fix would add a validation function (similar to validateDnsLoc, validateDnsSshfp, etc.) that rejects any content containing zone metacharacters ($, newlines), and remove the TODO at line 148.
CVE-2026-41234 has a CVSS score of 7.6 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (2.3.7). Upgrading removes the vulnerable code path.
composer
froxlor/froxlor (<= 2.3.6)froxlor/froxlor → 2.3.7 (composer)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2026-41234 is reachable in your applications. Explore open-source security for your team.
See if CVE-2026-41234 is reachable in your applications. Get a demo
Already deployed Kodem? See CVE-2026-41234 in your environment →Upgrade froxlor/froxlor to 2.3.7 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-41234 is a high-severity security vulnerability in froxlor/froxlor (composer), affecting versions <= 2.3.6. It is fixed in 2.3.7.
CVE-2026-41234 has a CVSS score of 7.6 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
froxlor/froxlor (composer) versions <= 2.3.6 is affected.
Yes. CVE-2026-41234 is fixed in 2.3.7. Upgrade to this version or later.
Whether CVE-2026-41234 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade froxlor/froxlor to 2.3.7 or later.