What is the CVSS score of CVE-2026-41230?

CVE-2026-41230 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Froxlor are affected by CVE-2026-41230?

Froxlor versions prior to 2.3.6 contain a DNS zone file injection vulnerability that allows authenticated customer accounts to manipulate DNS records and directives for managed domains, potentially…. A patch is available.

How to fix or mitigate CVE-2026-41230?

Within 24 hours: Identify all Froxlor installations and document current versions. Within 7 days: Apply vendor patch to Froxlor 2.3.6 or later (verify GitHub commit 47a8af5d is included); test in staging environment before production deployment. Within 30 days: Audit DNS zone files for unauthorized directives ($INCLUDE, $ORIGIN, $GENERATE) and review customer account activity logs for suspicious DNS record modifications during the vulnerability window.

Froxlor CVE-2026-41230

EUVD-2026-25180 HIGH

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-04-23 GitHub_M

GHSA-47hf-23pw-3m8c

Authentication Bypass Froxlor

8.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Apr 27, 2026 - 17:01 nvd

Patch available

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:59 vuln.today

Patch available

Apr 23, 2026 - 06:16 EUVD

EUVD ID Assigned

Apr 23, 2026 - 04:00 euvd

EUVD-2026-25180

Analysis Generated

Apr 23, 2026 - 04:00 vuln.today

CVE Published

Apr 23, 2026 - 03:47 nvd

HIGH 8.5

DescriptionGitHub Advisory

Froxlor is open source server administration software. Prior to version 2.3.6, DomainZones::add() accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the content field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g., NAPTR, PTR, HINFO), content validation is entirely bypassed. Embedded newline characters in the content survive trim() processing, are stored in the database, and are written directly into BIND zone files via DnsEntry::__toString(). An authenticated customer can inject arbitrary DNS records and BIND directives ($INCLUDE, $ORIGIN, $GENERATE) into their domain's zone file. Version 2.3.6 fixes the issue.

AnalysisAI

DNS zone file injection in Froxlor versions prior to 2.3.6 allows authenticated customers to inject arbitrary BIND directives and DNS records through unvalidated record types and unsanitized newline characters. Attackers with low-privilege customer accounts can manipulate DNS resolution for managed domains by embedding malicious directives like $INCLUDE, $ORIGIN, or $GENERATE into zone files, potentially redirecting traffic, creating unauthorized records, or disrupting DNS services. CVSS 8.5 with scope change indicates impact beyond the vulnerable component. Vendor patch released in version 2.3.6 (GitHub commit 47a8af5d). No CISA KEV listing or public exploit identified at time of analysis, but attack complexity is low (AC:L) for authenticated users.

Technical ContextAI

Froxlor is a PHP-based web hosting control panel for managing DNS, web servers, and email services. The vulnerability exists in the DomainZones::add() function which handles customer-submitted DNS record creation. BIND (Berkeley Internet Name Domain) is the underlying DNS server software that reads zone files as text configurations. The affected code path fails to implement a whitelist for DNS record types (allowing exotic types like NAPTR, PTR, HINFO to bypass validation) and does not sanitize newline characters (\n) in the content field before database storage. The trim() function only removes leading/trailing whitespace, not embedded newlines. When DnsEntry::__toString() serializes database records to BIND zone file format, these unescaped newlines enable multi-line injection. CWE-93 (Improper Neutralization of CRLF Sequences) applies as the root cause is failure to neutralize control characters in output destined for a structured format. BIND's zone file parser interprets newlines as record delimiters and recognizes special directives ($INCLUDE for file inclusion, $ORIGIN for domain scoping, $GENERATE for bulk record creation), making this a classic injection vulnerability.

RemediationAI

Upgrade to Froxlor version 2.3.6 immediately, available from https://github.com/froxlor/froxlor/releases/tag/2.3.6. The fix (commit 47a8af5d9523cb6ec94567405cfc2e294d3a1442 at https://github.com/froxlor/froxlor/commit/47a8af5d9523cb6ec94567405cfc2e294d3a1442) implements DNS record type whitelisting and newline sanitization in the content validation path. For environments unable to upgrade immediately, implement compensating controls: restrict customer DNS record management privileges to only trusted administrative users (converts PR:L to PR:H, reducing exploitability), enable BIND's zone file syntax validation with strict error handling to prevent malformed zones from loading (set check-names strict and validate zone files before reload), and monitor BIND logs for unusual $INCLUDE/$ORIGIN/$GENERATE directive usage or zone transfer errors indicating injection attempts. Note that disabling customer DNS management entirely eliminates the attack surface but breaks core Froxlor functionality for self-service hosting. Audit existing zone files for injected content by searching for unexpected newline-separated records or BIND directives in database content fields before applying the patch.