---
id: CVE-2026-54543
title: Froxlor is open source server administration software
summary: >-
  Froxlor is open source server administration software. Prior to 2.3.8, the
  DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php
  accepts user-controlled record and type values without rejecting line
  delimiters, tab char…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-74
  - CWE-20
vendor: froxlor
product: froxlor/froxlor
affected:
  - froxlor/froxlor <= 2.3.7
patched:
  - froxlor/froxlor 2.3.8
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:02:26.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54543'
references:
  - url: >-
      https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a
    label: security-advisories@github.com
  - url: 'https://github.com/froxlor/froxlor/releases/tag/2.3.8'
    label: security-advisories@github.com
  - url: 'https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-5rw4-4665-cvwf'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00428
epssPercentile: 0.367
aliases:
  - GHSA-5rw4-4665-cvwf
ecosystem: composer
ingestedAt: '2026-08-18T21:22:59.939Z'
---

## Overview

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54543)

Affected packages:

- `froxlor/froxlor <= 2.3.7`

Patched in:

- `froxlor/froxlor 2.3.8`

Source: https://github.com/advisories/GHSA-5rw4-4665-cvwf