CVE-2026-54347

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

// Only strips non-printable chars. < and > (0x3C/0x3E) pass through unmodified.
$content = preg_replace('/[^\x09\x20-\x7E]/', '', $content);
$content = Dns::encloseTXTContent($content);  // only wraps in quotes, no HTML encoding

public static function wordwrap(array $attributes): string {
    return wordwrap($attributes['data'], 100, '<br>', true);  // no htmlspecialchars()
}

{% else %}
    {{ td.data|raw }}   {# string from wordwrap(), rendered without escaping #}
{% endif %}

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; ...

http://TARGET/admin_domains.php?page=domaindnseditor&domain_id=<id>

T=$(curl -sc /tmp/c http://TARGET/index.php | grep -oP 'csrf-token" content="\K[^"]+') && \
curl -sc /tmp/c -b /tmp/c http://TARGET/index.php \
  -d "loginname=admin&password=PASS&dologin=1&send=send&csrf_token=$T" -o /dev/null && \
curl -sb /tmp/c "http://TARGET/admin_domains.php?page=domaindnseditor&domain_id=ID" \
  | grep -o '<img src=x[^>]*>'

<img src=x onerror=alert(document.domain)>

Type: Stored Cross-Site Scripting (Stored XSS)

Who is impacted: Any Froxlor installation with DNS editor functionality enabled. The attack requires a low-privilege customer account with dnsenabled = 1, a standard feature granted to hosting customers. The victim is any administrator who views the affected domain's DNS configuration.

A real-world attacker would replace alert() with a payload that silently exfiltrates the admin session cookie, then uses it to create a backdoor admin account, read all customer credentials, or execute arbitrary commands on the underlying server through Froxlor's system configuration interface.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-54347 has a CVSS score of 8.7 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.3.8); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Apply one of the following:

Option A (recommended), Remove |raw from the table template:

{# templates/Froxlor/table/table.html.twig:57 #}
{{ td.data }}   {# Twig auto-escaping handles it #}

Callbacks that intentionally return HTML (e.g. action buttons) should return a structured array with a macro key instead of a raw string.

Option B, Escape in the callback:

// lib/Froxlor/UI/Callbacks/Text.php
public static function wordwrap(array $attributes): string {
    return wordwrap(htmlspecialchars($attributes['data'], ENT_QUOTES, 'UTF-8'), 100, '<br>', true);
}

Option C, Sanitize at input:

// lib/Froxlor/Api/Commands/DomainZones.php after line 160
$content = htmlspecialchars($content, ENT_QUOTES, 'UTF-8');

Also remove 'unsafe-inline' and 'unsafe-eval' from the CSP header in lib/Froxlor/UI/Panel/UI.php:140.

If possible, please apply for a CVE when publishing.

1. What is CVE-2026-54347? CVE-2026-54347 is a high-severity cross-site scripting (XSS) vulnerability in froxlor/froxlor (composer), affecting versions <= 2.3.7. It is fixed in 2.3.8. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-54347? CVE-2026-54347 has a CVSS score of 8.7 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of froxlor/froxlor are affected by CVE-2026-54347? froxlor/froxlor (composer) versions <= 2.3.7 is affected.
4. Is there a fix for CVE-2026-54347? Yes. CVE-2026-54347 is fixed in 2.3.8. Upgrade to this version or later.
5. Is CVE-2026-54347 exploitable, and should I be worried? Whether CVE-2026-54347 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-54347 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-54347? Upgrade froxlor/froxlor to 2.3.8 or later.

Other vulnerabilities in froxlor/froxlor