CVE-2026-30932 Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

What is CVE-2026-30932?

CVE-2026-30932 is a high-severity code injection vulnerability in froxlor, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

Weakness: CWE-74

Which versions are affected by CVE-2026-30932?

2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.

Products include Froxlor Froxlor.

How do I fix CVE-2026-30932?

Upgrade froxlor/froxlor to 2.3.5 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-30932 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30932 exists.

Other vulnerabilities in froxlor

• CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution Critical 10.0
• CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor Critical 9.9
• CVE-2023-0671 Code Injection in froxlor/froxlor Critical 9.9
• CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor Critical 9.8
• CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x6w6-2xwp-3jh6.