CVE-2026-54543

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.

• CWE-74

• https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a
• https://github.com/froxlor/froxlor/releases/tag/2.3.8
• https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54533vantage6 is an open-source infrastructure for privacy preser…6.9
• CVE-2026-54538xrdp is an open source RDP server. In versions 0.10.6 and pr…7.5
• CVE-2026-5454A vulnerability was found in GRID Organiser App up to 1.0.5 …3.3
• CVE-2026-54540Pheditor is a single-file editor and file manager written in…8.8
• CVE-2026-54541Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…3.7
• CVE-2026-54542Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…3.7
• CVE-2026-54544Fireshare facilitates self-hosted media and link sharing. Pr…7.2
• CVE-2026-54545wakaru is a JavaScript decompiler and unminifier toolkit. Fr…7.1
• CVE-2026-54546CloudTAK is a browser-based Common Operating Picture and sit…5
• CVE-2026-54547Meta Ads MCP is a Model Context Protocol (MCP) server that l…7.4
• CVE-2026-54548kas is a setup tool for bitbake based projects. Prior to 5.4…3.3
• CVE-2026-54549Meta Ads MCP is a Model Context Protocol (MCP) server that l…8.3