CVE-2026-41234

Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives (`$INCLUDE`, `$GENERATE`) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron. This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records. Version 2.3.7 contains an updated patch.

• CWE-74

• https://github.com/advisories/GHSA-x6w6-2xwp-3jh6
• https://github.com/froxlor/froxlor/releases/tag/2.3.7
• https://github.com/froxlor/froxlor/security/advisories/GHSA-37m5-m4q3-fc6x
• https://github.com/froxlor/froxlor/security/advisories/GHSA-37m5-m4q3-fc6x

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41228Froxlor is open source server administration software. Prior…9.9
• CVE-2026-41229Froxlor is open source server administration software. Prior…9.1
• CVE-2026-41230Froxlor is open source server administration software. Prior…8.5
• CVE-2026-41231Froxlor is open source server administration software. Prior…7.5
• CVE-2026-41232Froxlor is open source server administration software. Prior…5
• CVE-2026-41233Froxlor is open source server administration software. Prior…5.4
• CVE-2026-41235Froxlor is open source server administration software. Versi…8.6
• CVE-2026-41236Froxlor is open source server administration software. Versi…8.8
• CVE-2026-41237Froxlor is open source server administration software. In ve…8.6
• CVE-2026-41238DOMPurify is a DOM-only cross-site scripting sanitizer for H…6.9
• CVE-2026-41239DOMPurify is a DOM-only cross-site scripting sanitizer for H…6.8
• CVE-2026-4124The Ziggeo plugin for WordPress is vulnerable to Missing Aut…5.4