CVE-2026-41234: Froxlor: BIND Zone File Injection via TXT Record Content

Synopsis

This is a BIND zone file injection vulnerability in Froxlor, an open source server administration panel. An authenticated user with DNS editing permissions can inject newline characters into TXT record content via the DomainZones.add API endpoint, breaking out of the intended record line in the generated zone file and inserting arbitrary BIND directives or DNS records. Successful exploitation lets an attacker tamper with DNS zone data at a high level of impact, potentially redirecting traffic, inserting rogue DNS records, or triggering dangerous BIND directives such as $INCLUDE or $GENERATE. HarborGuard is tracking this advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoint is exposed over the network, so an attacker must be able to reach the Froxlor service remotely.

• AuthenticationRequired

  The attacker must hold a valid low-privilege customer account with DNS editing permissions enabled; anonymous access is not sufficient.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits a crafted API request directly and the injected zone file is written by the DNS rebuild cron without any user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race requirements, or memory-layout dependencies on the attacker.

Blast Radius

• Attacker inserts arbitrary DNS records (A, MX, CNAME) into the victim zone file, redirecting traffic for any hostname in the affected zone.
• Attacker injects $INCLUDE or $GENERATE BIND directives, potentially causing BIND to read attacker-influenced files from disk or generate large numbers of synthetic records.
• Zone integrity is broken at a high impact level, enabling ongoing manipulation of DNS responses served to all clients resolving the affected domain.
• Availability of the DNS service is degraded at a low level, for example through malformed directives that cause BIND to fail zone loading.