8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41237

CVE-2026-41237: Froxlor has an incomplete fix for CVE-2026-30932

Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses \s+ which matches newlines (allowing embedded newlines to pass), TLSA matchingType=0 has no upper bound on hex data length, and all validators return raw input without zone-file escaping. Version 2.3.7 contains an updated patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41237

CVE-2026-41237:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
froxlor/froxlor	composer	<= 2.3.6	2.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a result of improper input validation and a lack of output encoding when processing DNS records of the types LOC, RP, SSHFP, and TLSA. An authenticated user with DNS management permissions can exploit this to inject arbitrary records into the bind9 zone file, potentially leading to domain hijacking or DNS amplification attacks.

The vulnerability exists in a multi-step process that would be visible in a runtime profile:

The DomainZones::add function is the primary entry point that receives the malicious user input. Before the patch, it performed no validation at all for the affected record types.
The patch introduced new validation functions in the Validate class. However, these functions are flawed. Validate::validateDnsLoc uses a regex with \s+ that allows newlines, enabling an attacker to inject additional DNS records. Validate::validateDnsTlsa fails to enforce a maximum length for certain records, allowing for oversized payloads.
A fundamental flaw is that all the new validation functions (validateDnsLoc, validateDnsTlsa, validateDnsRp, validateDnsSshfp) return the original, unescaped input. The DomainZones::add function then uses this raw data, which is subsequently concatenated directly into the DNS zone file, causing the injection (CWE-74).

During an exploit, a profiler would show a call to DomainZones::add, which in turn calls one of the flawed Validate methods before the malicious data is processed and written to the zone file.

Vulnerable functions

DomainZones::add

lib/Froxlor/Api/Commands/DomainZones.php

This is the main API function for adding DNS records. Before the patch, it performed no validation for LOC, RP, SSHFP, and TLSA record types, directly using the user-provided '$content'. After the patch, it calls the new validation functions but still uses the raw, unescaped content that is returned, which is then written to the zone file, leading to an injection vulnerability.

Validate::validateDnsLoc

lib/Froxlor/Validate/Validate.php

This validation function was added to secure LOC record content. However, it is flawed because it uses '\\s+' in its regex, which matches any whitespace character, including newlines. This allows an attacker to bypass the validation with a crafted LOC record containing newlines, leading to the injection of arbitrary records into the DNS zone file.

Validate::validateDnsTlsa

lib/Froxlor/Validate/Validate.php

This validation function was added to secure TLSA record content. It is incomplete because for a 'matchingType' of 0, it checks for a minimum length but fails to enforce a maximum length on the hexadecimal data. This allows an attacker to inject an arbitrarily large payload, which could be used for data exfiltration or in DNS amplification attacks.

Validate::validateDnsRp

lib/Froxlor/Validate/Validate.php

This validation function, while correctly checking the format of RP records, is part of the vulnerability because it returns the original, unescaped '$input' string. This raw string is then used to construct the zone file, and the lack of output encoding is a core part of the injection vulnerability.

Validate::validateDnsSshfp

lib/Froxlor/Validate/Validate.php

This validation function, while correctly checking the format of SSHFP records, is part of the vulnerability because it returns the original, unescaped '$input' string. This raw string is then used to construct the zone file, and the lack of output encoding is a core part of the injection vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.