CVE-2026-30932 HIGH

CVE-2026-30932: Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Vendor Froxlor
Product froxlor
Weakness CWE-74
Published March 24, 2026
Last update March 25, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

Key dates

02Disclosure timeline

March 24, 2026 CVE published
March 25, 2026 Record updated