CVE-2026-54543: DNS Resource Record (RR) Injection in Froxlor DomainZones API

Vulnerability ID: CVE-2026-54543
CVSS Score: 5.4
Published: 2026-08-18

CVE-2026-54543 is a DNS Resource Record (RR) Injection vulnerability in Froxlor, an open-source server administration control panel. Prior to version 2.3.8, the DomainZones.add API command failed to perform strict sanitization and validation on the user-controlled record (label) and type parameters before serializing them into BIND-compatible zone files. An authenticated customer with DNS zone management permissions can inject control characters, breaking out of the original record context to define unauthorized resource records within managed zones.

TL;DR

Authenticated users with DNS edit permissions can inject arbitrary DNS records into BIND zone files via Froxlor's unsanitized DomainZones.add API.

Technical Details

CWE ID: CWE-74
Attack Vector: Network
CVSS: 5.4 (Medium)
EPSS: Not Assigned
Impact: DNS manipulation within managed zones
Exploit Status: None
KEV Status: Not Listed

Affected Systems

Froxlor Server Administration Control Panel prior to 2.3.8
Froxlor: < 2.3.8 (Fixed in: 2.3.8)

Code Analysis

Commit: a4f09f0

Sanitize record and type in DomainZones.add API command to prevent DNS Resource Record injection

@@ -120,6 +120,28 @@ public function add()
        }

        $record = trim(strtolower($record));
+       $record = preg_replace('/[^\x20-\x7E]/', '', $record);
+
+       $type = trim(strtoupper($type));
+       if (!in_array($type, [
+           'A',
+           'AAAA',
+           'CAA',
+           'CNAME',
+           'DNAME',
+           'LOC',
+           'MX',
+           'NAPTR',
+           'NS',
+           'RP',
+           'SRV',
+           'SSHFP',
+           'TLSA',
+           'TXT'
+       ])) {
+           $errors[] = lng('error.dns_unknown_type');
+       }

Mitigation Strategies

Upgrade Froxlor to version 2.3.8 or higher.
Implement a WAF rule to filter control characters like CR, LF, and semicolon from domain validation parameters.
Perform scheduled integrity scans of generated BIND zone configuration files on the host.

Remediation Steps:

Fetch the latest stable release of Froxlor 2.3.8 using Git or your system package manager.
Apply the patch from commit a4f09f09fa71337b6cdff364d0a641d631a0130a to existing 2.3.x systems if an immediate major upgrade is not possible.
Validate the output BIND zone configuration files for formatting compliance.
Restart or reload the BIND system service to flush any active injected cache entries.